Error when enabling TLS for email.

[hutsellmA]

We recently updated our Splunk infrastructure to 8.1 and before we upgraded, the enable TLS option was checked on the mail server settings. The alert_actions.conf has not changed at all. Now for emails being sent, we receive the following error in the python.log:

sendemail:456 - [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:742) while sending mail to: <EMAIL_ADDRESS>

If I manually add use_tls = 1 in that conf file, there are no errors, but if enabled on the web UI, it errors with the above. 

I am not sure what else to check here as nothing has changed except for the upgrading of the Splunk version on the servers. Has anyone else experienced this?

[burwell · Accepted solution]

Hi. Did you see this Splunk answers?

https://community.splunk.com/t5/Splunk-Enterprise/Sendmail-sslv3-alert-handshake-failure/m-p/297554

Sounds like a possible cipher suite issue.