Deployment Architecture

Can you help me with my Amazon Web Services ELB with search head cluster Issues?

Path Finder

I have a Splunk 7.1.2 cluster, using Search Head Cluster with AWS Load Balancer. It works fine. The server.conf says

httpport = 443
enableSplunkWebSSL = true
privKeyPath = /path/to/mycert.key
caCertPath = /path/to/mycert.pem

Now I'm deploying a brand new cluster with the 7.2.3 version, with the same server.conf, but the load balancer doesn't recognize the instances as Healthy. In the splunkd.log, for every check from the load balancer, which is a get on https://splunkhostIP/en-US/account/login?return_to=%2Fen-US%2F, I receive these two messages when It happens.

 01-30-2019 21:27:18.107 +0000 WARN  SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client hello C', alert_description='handshake failure'.
01-30-2019 21:27:18.107 +0000 WARN  HttpListener - Socket error from while idling: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher

The IP in the message is a Loadbalancer internal IP, calling the instance for healthcheck.

The old search head cluster instances don't show me these same warning messages.

The old cluster has the exact same scenario and except for the Splunk version.

The certificate file is the same for both, and they work exactly alike, calling on the browser with a name, for the Certificate is a Digicert Signed.

And calling using IP, they complain about the certificate, but when I accept to see even "unsafe", they have the same behavior.

I saw some issues with the same Warning messages, but the issues are not like mine.

I really appreciate any help.

New Member

I am encountering the same issue. After upgrading from 6.5.x -> 6.6 -> 7.3, communication between the ELB and instances behind result in time out. Though we set the ciphers on the ELB to explicitly use stronger algorithms, the ELB uses ssl3 ciphers.

When going to the search head directly, however, communication with TLSv1.2 ciphers are successful.

Not sure exactly what the issue is, but all tests allude to a bad config on the ELB.

If functionality is more important than security, you can enable all cipher suites. However, it is not recommended you keep these settings. If you come across a solution, please be sure to share it on the thread.


sslCiphers = ALL

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...