topic Re: Getting SSL_GET_RECORD:wrong version number error in Splunk Light 7.3.4 in Splunk Enterprise

Getting SSL_GET_RECORD:wrong version number error in Splunk Light 7.3.4

davoilar — Wed, 30 Sep 2020 04:31:57 GMT

Hello!

I'm using version 7.3.4 of Splunk Light, rpm install on RHEL 8, forwarder same version and I'm getting this error in the forwarder log:"while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number", what is causing that?

Splunk console recognizes the host the forwarder is located, but unable to exchange data.

Thanks,
Dave

Re: Getting SSL_GET_RECORD:wrong version number error in Splunk Light 7.3.4

xavierashe — Wed, 30 Sep 2020 04:31:32 GMT

This looks like a TLS/SSL version mismatch. Try debugging the connection using

$ openssl s_client -debug -connect SPLUNK_SERVER:PORT

and then try adding flags from this set: -no_ssl2, -no_ssl3 and -no_tls1 to work out which version of SSL/TLS has to be enabled for the connection to succeed.

Re: Getting SSL_GET_RECORD:wrong version number error in Splunk Light 7.3.4

davoilar — Mon, 09 Mar 2020 18:29:06 GMT

Hello,

It is a bit disconcerting that both endpoints, server and forwarder, we installed on RHEL 8 via their respective RPM packages and I see this out of the box. Both end appear to be using TLS1.2.

Thanks,
Dave

Re: Getting SSL_GET_RECORD:wrong version number error in Splunk Light 7.3.4

xavierashe — Mon, 09 Mar 2020 18:51:28 GMT

Agreed. Is the connection going through web proxy or load balancer that could be monkeying with the TLS handshake?

Re: Getting SSL_GET_RECORD:wrong version number error in Splunk Light 7.3.4

davoilar — Mon, 09 Mar 2020 18:54:58 GMT

Nope. these are talking directly to one another with out a load balancer, or nginx or any other proxy mechanism in the middle.

:^)

Dave