skills.rest
chambear2809
chambear2809COMMUNITY
Explore all skills by this author →
GitHub

splunk-platform-pki-setup

Render per-host Splunk PKI certificates, CSRs, and rotation runbooks.

36|7|Updated Mar 17, 2026
Search Tags:#automation#tls#rotation#certificate#splunk#pki
One-click install
npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-platform-pki-setup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: splunk-platform-pki-setup
Source: https://github.com/chambear2809/splunk-cisco-skills/tree/main/skills/splunk-platform-pki-setup
Command: npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-platform-pki-setup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Render and orchestrate PKI lifecycles for Splunk deployments, enabling private or public PKI workflows while ensuring CA private keys are never exposed in artifacts.

Core Features & Use Cases

  • Render private PKI (Root + Intermediate) leaves and per-host certificates for Splunk Web, splunkd, S2S, HEC, KV Store EKU, and distribution payloads.
  • Render public PKI CSRs and operator handoff artifacts for Vault PKI, ACME/cert-manager, AD CS, EJBCA, or other CAs, with accompanying handoff checklists.
  • Support optional surfaces (Edge Processor, LDAPS, SAML SP signing certs, replication TLS, SHC/LM/DS/UF) and delegated rotation runbooks.
  • Enforce TLS policy presets, FIPS posture, leaf validity day caps, cluster-wide trust distribution, preflight/verify checks, and CLI trust alignment.
  • Supports render-first, dry-run, preflight, apply, rotate, and inventory phases, plus a delegated rotation plan.

Quick Start

Render a private PKI for a 3-indexer cluster and 3 SHC, then install per-host leaves and start the rotation plan.

Frequently Asked Questions about splunk-platform-pki-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Splunk TLS certificate rotation across a cluster?▼

Splunk TLS certificate rotation is automated by rendering per-host cert material, CSRs, and rotation runbooks that delegate rotation to indexer-cluster-setup runbooks without exposing private keys. It supports render-first, preflight, apply, rotate, and inventory phases.

How do I generate Splunk PKI certificates for splunkd, HEC, and S2S without exposing CA private keys?▼

Splunk PKI certificates for splunkd, HEC, and S2S are generated by rendering private Root and Intermediate CA leaves and per-host certificates directly, ensuring CA private keys are never exposed in the distributed artifacts or payloads.

Can I use a public PKI CSR workflow with Splunk and AD CS or cert-manager?▼

Public PKI CSRs for Splunk are supported by rendering operator handoff artifacts designed for external CAs like AD CS, cert-manager, Vault PKI, or EJBCA, accompanied by handoff checklists to complete the certificate lifecycle.

Does Splunk PKI setup enforce FIPS mode and TLS policy presets for KV Store and LDAPS?▼

Splunk PKI setup enforces FIPS mode, TLS policy presets, and leaf validity day caps across all surfaces including KV Store EKU, LDAPS, and SAML SP signing certs to maintain strict security postures.

What is the best way to manage Splunk indexer cluster TLS distribution and preflight checks?▼

Splunk indexer cluster TLS distribution is managed by applying cluster-wide trust distribution and per-surface overlays, executing preflight and verify checks to ensure CLI trust alignment before delegating the actual rotation runbooks.

What Splunk surfaces are supported for per-host certificate overlays and replication TLS?▼

Splunk surfaces supported for per-host certificate overlays and replication TLS include Web, splunkd, S2S, HEC, KV Store, SHC, License Manager, Deployment Server, Monitoring Console, Edge Processor, LDAPS, and SAML SP.

Related Skills

Explore More Software Engineering Skills→
chambear2809chambear2809
36

splunk-enterprise-public-exposure-hardening

Render Splunk Enterprise hardening templates for on-prem deployments.

Community
Advanced
chambear2809chambear2809
36

splunk-indexer-cluster-setup

Orchestrate Splunk Enterprise indexer cluster setup with per-host server.conf rendering.

Community
Advanced
KaiserWhoLearnsKaiserWhoLearns

ssl-certificate-management

Automate SSL/TLS certificate provisioning, renewal, and monitoring across infrastructure.

Community
Advanced
williamzujkowskiwilliamzujkowski
6

Cryptographic Security Validator

Audit TLS, certificates, and key management against NIST/FIPS standards.

Community
Advanced