topic Re: ES Glass Table not loading after activating requireClientCert in sslConfig (SSLError) in Splunk Enterprise Security

ES Glass Table not loading after activating requireClientCert in sslConfig (SSLError)

tsmadi — Wed, 30 Sep 2020 05:19:15 GMT

Hello,

I have a problem with Splunk ES Glass Tables not loading when setting the requireClientCert=true in sslConfig. Of course I have the complete SSL setup working fine with sslVersions=tls1.2 using certificates singed by own CA.

When trying to access the Glass Tables from ES menu, I get the following error message:

HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /servicesNS/nobody/SplunkEnterpriseSecuritySuite/storage/collections/config/SplunkEnterpriseSecuritySuite_glasstables (Caused by SSLError(SSLError(1, u'[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:742)'),))

p.s note: I have tried to add ssl3 to allowed list in sslVersions just to check if this is the problem but I end up with KVStore failure. However, this is not how I want to solve it.

Thank you for your interactivity and responses in advance 🙂

Regards

Re: ES Glass Table not loading after activating requireClientCert in sslConfig (SSLError)

swati_singh — Tue, 11 Aug 2020 07:32:59 GMT

Hi, did you manage to solve this issue? I am getting the same issue in another app.

Re: ES Glass Table not loading after activating requireClientCert in sslConfig (SSLError)

tsmadi — Sat, 06 Mar 2021 12:36:40 GMT

Hello,

Yes, I did solve it.

After Splunk support failing to solve it, I had to act on my own.

I solved it and Splunk support asked me to show them the solution and after they saw it, they were supposed to modify it and register a bug on my name but unfortunately they didn't.

If you are still having this problem let me know and I will post the solution.

Regards

Re: ES Glass Table not loading after activating requireClientCert in sslConfig (SSLError)

youngso — Mon, 08 Mar 2021 20:52:56 GMT

Yes. I am having an issue. Please post the solution.

Re: ES Glass Table not loading after activating requireClientCert in sslConfig (SSLError)

tsmadi — Thu, 11 Mar 2021 15:15:38 GMT

Hello,

Sorry for taking so long to reply, but Splunk support should have taken care of this issue long time ago!

As promised, the solution for this issue is to enable the client authentication to use the SSL certificates provided for inter-server communication (Splunk components within the server) because the server is forced to authenticate all communications when requireClientCert=true.

To enable this go to

/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/lib/SplunkEnterpriseSecuritySuite_app_common/solnlib/packages/requests/sessions.py

Edit the file and modify the following Python tuple:

self.cert = ("Path to CA", "Path to certificate")

Save the file and restart splunk. The glass Tables should work now with no problem. However, you might need to troubleshoot other inter-Splunk communications based on your environment.

@youngso @swati_singh

Let me know how it goes!