topic Re: Splunk 6.3 forwarder is not sending data using SSL however Splunk 6.6 is working fine with the same settings in Security

Splunk 6.3 forwarder is not sending data using SSL however Splunk 6.6 is working fine with the same settings

reach2tushar — Tue, 29 Sep 2020 15:23:55 GMT

Splunk 6.3 forwarder is not sending data using SSL while Splunk 6.6 is working fine with the same settings.

Following entries are added in outputs.conf on forwarder:
[tcpout]
defaultGroup =Splunk_Indexers

[tcpout:Splunk_Indexers]
disabled = false
server = servername:9997
compressed = false
sslRootCAPath = "splunk-home"\etc\auth\NewAuth\CARoot.crt
sslCertPath = "splunk-home"\etc\auth\NewAuth\servercert.pem

Following entries are added in inputs.conf on indexer:
[splunktcp-ssl://9997]
connection_host = ip

[SSL]
compressed = false
password = $5SD$==
requireClientCert = false
rootCA = "splunk-home"\etc\auth\NewAuth\CARoot.crt
serverCert = "splunk-home"\etc\auth\NewAuth\servercert.pem

Can please help to fix this issue as the above settings are working fine in Splunk 6.6 forwarder but giving following error in splunkd.log on Splunk 6.3 forwarder:
"Connection to host=servername:9997 failed. sock_error = 0. SSL Error = error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed"

Re: Splunk 6.3 forwarder is not sending data using SSL however Splunk 6.6 is working fine with the same settings

n028167 — Fri, 18 Aug 2017 13:38:10 GMT

Check your underlying cert on 6.3. Believe this default expired last year. You'll want 6.4 or higher if using default cert.

Re: Splunk 6.3 forwarder is not sending data using SSL however Splunk 6.6 is working fine with the same settings

reach2tushar — Mon, 21 Aug 2017 07:00:41 GMT

Hi, We are using our own CA certificates in both 6.3 and 6.6. Could you please suggest?

Re: Splunk 6.3 forwarder is not sending data using SSL however Splunk 6.6 is working fine with the same settings

cameronjust — Tue, 03 Oct 2017 01:31:47 GMT

I'm seeing the same problems. Likely due to cipher issues with certain ciphers being deprecated.

Even the if mentioned here for 6.0 and 6.1 does not help.

http://docs.splunk.com/Documentation/Splunk/6.6.3/ReleaseNotes/KnownIssues#Data_input_issues