topic Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security) in Splunk Enterprise Security

Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

JohannLiebert92 — Tue, 29 Sep 2020 18:10:13 GMT

Hi everyone,

I'm having trouble to access Splunk web on HTTPS. After I installed ES, HTTPS was on automatically for Splunk web, however I couldn't access it while it is on HTTPS. I tried to disable HTTPS manually by editing the web.conf and able to access the web again. As such, I would like to gather some insights/suggestion what could potentially be the cause of this. Has anyone encountered similar issue in their environment before?

P/s: While web HTTPS is on, I tried to access Splunk web on http, (e.g. http://myserver:8000), I was returned with "connect failed" on the browser page. And I saw the warn message "Socket error from while idling:error 1408F10B:SSL_routines:SSL_GET_RECORD:wrong version number" was generated in splunkd.log

Thanks!

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

p_gurav — Fri, 23 Feb 2018 11:18:58 GMT

which splunk version you are using?

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

JohannLiebert92 — Fri, 23 Feb 2018 12:06:18 GMT

Hi p_gurav,

I'm using Splunk 7.0.1.

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

p_gurav — Fri, 23 Feb 2018 12:12:00 GMT

when you are accessing https://your-server:8000 , what error your getting?

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

JohannLiebert92 — Fri, 23 Feb 2018 12:19:47 GMT

I din't pay attention to exact message, will need to revert back to you once I have access to the server on Monday again. But it looked like one of those responses when page is unavailable, e.g. accessing splunk web on HTTP when HTTPS is enabled.

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

gjanders — Sun, 25 Feb 2018 08:02:15 GMT

Can you please confirm that you are using a modern Chrome/Firefox or Edge browser to browse to https://myserver:8000 ?

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

Kendrick821 — Mon, 26 Feb 2018 09:46:44 GMT

please check if there is a proxy in between client machine and splunk server. Most likely the proxy has a policy of blocking SSL connection that is not trusted by the proxy.

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

skalliger — Mon, 26 Feb 2018 13:01:48 GMT

You did not mention whether you created a self-signed certificate before or not (or a real certificate issued by a CA). Splunk Enterprise Security is only working with HTTPS, it cannot be disabled.

Skalli

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

JohannLiebert92 — Wed, 28 Feb 2018 12:38:35 GMT

This really turned out to be the cause of the issue. There was a proxy which block the traffic from accessing the server. After Splunk server has been whitelisted we can access it with HTTPS.

Thanks everyone for helping!!!!

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

JohannLiebert92 — Wed, 28 Feb 2018 12:43:20 GMT

Hi skalliger, thanks for helping. At this stage I am using the default Splunk web certificate, (and real certificate for splunkd). The cause of the issue turned out to be the proxy which blocked the traffic from accessing it. Thanks!!

Re: Troubles Accessing Splunk Web With HTTPS (Enterprise Security)

JohannLiebert92 — Wed, 28 Feb 2018 12:47:29 GMT

Hi garethatiag, thanks for helping. Yes I tried Chrome and IE, however I just realized the internet settings for both Chrome and IE are shared, and thus the proxy block.