topic Re: Received fatal SSL3 alert in Getting Data In

Received fatal SSL3 alert

vr2312 — Tue, 29 Sep 2020 13:03:03 GMT

I am unable to connect to my Indexer ClusterMaster on Cloud on Port 8000.

On checking splunkd.log, i can observe some WARN messages as below.

Not sure if this is related.

03-01-2017 07:26:47.474 -0500 WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='unknown CA'.
03-01-2017 07:26:47.474 -0500 WARN HttpListener - Socket error from 127.0.0.1 while idling: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
03-01-2017 07:26:47.475 -0500 WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='unknown CA'.
03-01-2017 07:26:47.475 -0500 WARN HttpListener - Socket error from 127.0.0.1 while idling: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
03-01-2017 07:26:47.475 -0500 WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='unknown CA'.
03-01-2017 07:26:47.475 -0500 WARN HttpListener - Socket error from 127.0.0.1 while idling: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca

Re: Received fatal SSL3 alert

napomokoetle — Wed, 24 May 2017 11:37:21 GMT

Were you able to resolve this? I'm seeing it in one of my environments too.

Re: Received fatal SSL3 alert

vr2312 — Wed, 24 May 2017 11:47:10 GMT

This occurred due to the network peripherals failing when trying to communicate to the AWS Instances.

The data from our infrastructure to AWS was being sent in size (2 TBs per day) that the peripheral cannot tolerate the traffic any longer and ended up fluctuating and rebooting the devices.

The N/W team then maximized the data that can be sent across and that fixed the issue.

Re: Received fatal SSL3 alert

vr2312 — Wed, 24 May 2017 11:50:30 GMT

@napomokoetle

Please check whether the connectivity between the instances is normal.

In my case, the connectivity was majorly impacted due from the N/W end.

Once that was resolved, the issue subsided.

Re: Received fatal SSL3 alert

napomokoetle — Wed, 24 May 2017 18:50:20 GMT

Even though I'm getting these ssl errors on the Splunk proxy, it seems the data collections from the Splunk Universal Forwarder agents are still happening successfully.
Also, I see that the SSL3 errors only started after I upgraded the Splunk servers to v6.6. Any one know how to eradicate these ssl3 errors.

Re: Received fatal SSL3 alert

vr2312 — Thu, 25 May 2017 11:04:45 GMT

@napomokoetle

Please open a new "question" and post it there for users to look into it and respond.