topic Re: When trying to upgrade to 6.5.2, why am I unable to establish SSL connection via wget? in Security

When trying to upgrade to 6.5.2, why am I unable to establish SSL connection via wget?

chrishartsock — Wed, 01 Feb 2017 16:02:22 GMT

I am trying to upgrade one of our Splunk servers from 6.5.1 to 6.5.2. The way we usually do this is wget to get the rpm file, but when I run:

sudo wget -O splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.2&product=splunk&filename=splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64.rpm&wget=true'

I get the following:

--2017-02-01 10:31:55--  https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.2&product=splunk&filename=splunk-6.5.2-67571ef4b87d-linux-2.6-x86_64.rpm&wget=true
Resolving www.splunk.com (www.splunk.com)... 54.xxx.xx.196, 54.xxx.xx.56, 54.xxx.xx.242, ...
Connecting to www.splunk.com (www.splunk.com)|54.xxx.xx.196|:443... connected.
Unable to establish SSL connection.

Again, we have done this many times in the past with no issue. I would appreciate any suggestions.

Thanks

Re: When trying to upgrade to 6.5.2, why am I unable to establish SSL connection via wget?

jtacy — Wed, 01 Feb 2017 23:34:07 GMT

Would you happen to be using an old operating system like RHEL5? I don't know when the config changed but the Splunk download servers now seem to require that clients have TLS SNI support. That's not really a big deal for newer clients but it doesn't look like this was in the OpenSSL release in RHEL5, as one example. The site seems to insist on HTTPS so you might be stuck scp'ing the file over to your systems unless you want to locate or build a wget or curl binary that's statically-linked to a more recent OpenSSL version. Maybe Splunk will share a non-HTTPS download location!

Re: When trying to upgrade to 6.5.2, why am I unable to establish SSL connection via wget?

chrishartsock — Thu, 02 Feb 2017 13:43:52 GMT

@jtacy thank you for the response, but it turns out it was a firewall bugging out on hour side.

Thanks