Streaming AWS data to Splunk using Firehose

[segevgal87]

Hi,

I'm trying to stream AWS logs using the Kinesis firehose method. I followed a tutorial and verified each step a few times.
I have generated a certificate for my Splunk Enterprise server using Let's Encrypt. My HEC is using that certificate and I know for sure that it is healthy and secure (used the following URL: https://host.domain.net:8088/services/collector/health)

I keep getting the following error on the monitoring of the Kinesis Firehose:

Could not connect to the HEC endpoint. Make sure that the certificate and the host are valid.
Splunk.SSLHandshake

Any ideas about what could go wrong?

Splunk Version ............ 8.0.0

[soumyasaha25 · Accepted solution]

Hi @segevgal87, although i have not tested it myself, based on the answer on this post it might be due to LetsEncrypt.

Could you try using an AWS ACM cert ? Do you get the same error with ACM certs.

[amiracle]

You need to have a valid certificate on either your Load Balancer (ELB for AWS deployments) or on your machine accepting the data from Firehose. The default HEC SSL Cert is not a valid third party SSL cert and will thus fail. You can either issue one from ACM (AWS Certificate Manager) so you can test your deployment. To make your life easier, you should use an ELB with a valid cert on a HF tier and then forward the data into your Splunk indexers. This link might help with how to set that up.

[segevgal87]

Hi,

I purchased a domain so I could try the ELB approach and it worked!
I guess the Let's Encrypt certificate was the issue...

Thanks amiracle and soumyasaha25