Hi,
I need to monitor a REST API that requires a client authentication certificate... using website monitoring 2.7.3 on Splunk Enterprise 7.2.0
Using cURL to call the API from the CLI works fine, so the certificate is fine, the web-service response is fine (FYI: it returns a .png image)
The data input gets triggered, a thread is added and later on the thread is removed but "Connection Failed" is all I get.
In the logs, I see the "INFO Performing ping" with the URL, then an ERROR SSL exception was thrown, stating an EOF occurred in violation of protocol (_ssl.c:676). How can I debug this situation to find out what may be the root-cause and solve this ?
I had to change the URI's below for security reasons but that will not keep you from understanding what it does.
Thanks in advance for any help you can offer to help me find and solve the root-cause.
Best Regards,
jmut
018-11-26 16:47:12,201 INFO Performing ping, url="https://servicestst.acme.com/Geo/NetworkAsset/get?VERSION=1.3.0&REQUEST=GetMap&SERVICE=WMS&LAYERS=AC..."
2018-11-26 16:47:12,337 ERROR An SSL exception was thrown when executing a web request against url=https://servicestst.acme.com/Geo/NetworkAsset/get?VERSION=1.3.0&REQUEST=GetMap&SERVICE=WMS&LAYERS=AC... EOF occurred in violation of protocol (_ssl.c:676)
From what I can tell, there are several reasons this may happen:
You might want to check the website on SSLLabs (https://www.ssllabs.com/ssltest/) to see if the protocols are old.
From what I have been able to find myself, this could have something todo with the version of SSL being used.
Perhaps related to the version of pyopenssl.py from which ssl is imported ?
My cURL uses TLSv1.2, an openssl s_client -connect also works using TLSv1.2 ...
Can I specify the SSL version to be used somehow ? as a parameter in a configuration stanza ? default ?
@LukeMurphey Just wondering if you already noticed my post ? Care to comment ? Need more information ?
I'm looking into this.