https://community.splunk.com/t5/Security/what-is-this-ssl-error/m-p/223196#M6324 <P>Hi,</P> <P>I have a 6.2.6 UFW that won't connect to my deployment server. Not sure why - getting this error when starting the forwarder:</P> <P>[hpov@ezpaasy splunk]$ ../../../bin/splunk start</P> <P>Splunk&gt; The IT Search Engine.</P> <P>Checking prerequisites...<BR /> Checking mgmt port [8089]: open<BR /> Checking conf files for problems...<BR /> ERROR SSLCommon - Can't read CA list<BR /> ERROR ServerConfig - Couldn't initialize SSL Context for HTTPClient in ServerConfig<BR /> Done<BR /> All preliminary checks passed.</P> <P>Starting splunk server daemon (splunkd)...<BR /> Declared role=universal_forwarder.<BR /> Done</P> <P>And this error appears in the splunkd.log:</P> <P>09-27-2016 10:27:38.731 -0400 ERROR HTTPClient - Should have gotten at least 3 tokens in status line, while getting response code. Only got 0.<BR /> 09-27-2016 10:27:38.731 -0400 INFO HttpPubSubConnection - Secure HTTP POST failed: Unknown read error<BR /> 09-27-2016 10:27:38.731 -0400 INFO HttpPubSubConnection - Could not obtain connection, will retry after=80 seconds.</P> <P>Any suggestions? The deployment server is reachable and running. It is not busy, or over-worked. </P> Tue, 27 Sep 2016 14:29:29 GMT a212830 2016-09-27T14:29:29Z https://community.splunk.com/t5/Security/what-is-this-ssl-error/m-p/223196#M6324 <P>Hi,</P> <P>I have a 6.2.6 UFW that won't connect to my deployment server. Not sure why - getting this error when starting the forwarder:</P> <P>[hpov@ezpaasy splunk]$ ../../../bin/splunk start</P> <P>Splunk&gt; The IT Search Engine.</P> <P>Checking prerequisites...<BR /> Checking mgmt port [8089]: open<BR /> Checking conf files for problems...<BR /> ERROR SSLCommon - Can't read CA list<BR /> ERROR ServerConfig - Couldn't initialize SSL Context for HTTPClient in ServerConfig<BR /> Done<BR /> All preliminary checks passed.</P> <P>Starting splunk server daemon (splunkd)...<BR /> Declared role=universal_forwarder.<BR /> Done</P> <P>And this error appears in the splunkd.log:</P> <P>09-27-2016 10:27:38.731 -0400 ERROR HTTPClient - Should have gotten at least 3 tokens in status line, while getting response code. Only got 0.<BR /> 09-27-2016 10:27:38.731 -0400 INFO HttpPubSubConnection - Secure HTTP POST failed: Unknown read error<BR /> 09-27-2016 10:27:38.731 -0400 INFO HttpPubSubConnection - Could not obtain connection, will retry after=80 seconds.</P> <P>Any suggestions? The deployment server is reachable and running. It is not busy, or over-worked. </P> Tue, 27 Sep 2016 14:29:29 GMT https://community.splunk.com/t5/Security/what-is-this-ssl-error/m-p/223196#M6324 a212830 2016-09-27T14:29:29Z https://community.splunk.com/t5/Security/what-is-this-ssl-error/m-p/223197#M6325 <P>Sounds like the SSL certificate has expired. The easiest way to renew it is to upgrade the forwarder to the latest version.</P> Wed, 28 Sep 2016 06:20:04 GMT https://community.splunk.com/t5/Security/what-is-this-ssl-error/m-p/223197#M6325 jkat54 2016-09-28T06:20:04Z https://community.splunk.com/t5/Security/what-is-this-ssl-error/m-p/223198#M6326 <P>In which case see if the docs have something newer than this: <BR /> <CODE>${SPLUNK_HOME}/bin/splunk createssl server-cert -d ${SPLUNK_HOME}/etc/auth -n server -l 2048 1&gt; /dev/null</CODE></P> <P>Let us know if that does it for ya.</P> Tue, 04 Oct 2016 12:29:43 GMT https://community.splunk.com/t5/Security/what-is-this-ssl-error/m-p/223198#M6326 sloshburch 2016-10-04T12:29:43Z