Certificate management (add, rotate, spa vault)

Summary

Certificate management (add, rotate, current Splunk TLS syntax)

Today splunk_ssl covers web / inputs / outputs with older setting names (rootCA, sslPassword, sslCertPath). Playbooks ansible/update_splunk_certs_web.yml and ansible/update_splunk_certs_inputs.yml copy certs; there is no first-class rotate path, no spa commands, and no coverage of management port / server.conf, forwarder-to-indexer, or deployment server / deployment client TLS and credentials. SPA targets current Splunk (examples use 10.x).

Issue should capture:

• Playbooks + spa entry (agent JSON): install and rotate certs in each Splunk place that needs them (Web, HEC/inputs, outputs/S2S, management/REST, DS phone-home / client). Use current server.conf / web.conf / inputs.conf / outputs.conf TLS keys for the Splunk versions SPA supports (look up sslConfig and related replacements at implement time — do not keep deprecated-only snippets).
• Deployment server credentials / TLS and other new Splunk auth knobs that belong with certs (client certs, passphrases).
• SPA vault for certificates and keys (existing !vault plus #52 store / env / Keychain). Users must be able to keep PEMs and private keys in vault rather than plaintext files in git. Completing this enhancement closes existing #30 (“Enable the user to put certificates into a vault”). Pickup may extract on the controller at run time (as #30 suggested) or decrypt via the spa vault path — pick one that matches #52; never print PEM or sslPassword values.
• Cert files that are not vaulted live outside git (auth dir / env path); config only has paths or vault refs. Rotation must not require a full spa deploy. -y for anything that restarts Splunk.
• Docs + feature catalog (#53). Verify certs meet normal TLS hygiene (not expired, RSA ≥2048 or P-256+, SHA-2) before deploying — do not bake sample PEMs into the repo.

Blocked by

Do not start implementation until #52 is done.

Related

• Closes existing #30 when this lands
• #53
• #64

Notes

Pickup-ready enhancement. Never print secrets, PEM material, Splunkbase passwords, AWS keys, or license XML. Skills and agents call spa only.

Start only after issue #52 is complete; read the spa entry and the existing ansible/update_splunk_certs_web.yml and ansible/update_splunk_certs_inputs.yml playbooks. Trace the current server.conf, web.conf, inputs.conf, and outputs.conf handling, then define install and rotation coverage for each listed Splunk location, vault-backed certificate handling, TLS validation, restart confirmation, and documentation without exposing secrets.