SSL flows within deployed app

[pdjhh]

Hi there.

We have our data ingestion ssl flows distributed to our heavy forwarders within an app. So the certs and outputs.conf are just under app/local and this has worked fine until now. What has happened is we have had a windows HF in the past whereas we've just stood up Linux HFs. The app gets pushed to the new linux HF but the secure connection will not come up.

The errors I'm seeing are these on the indexer side:
ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:59918. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

Searching that error points to lots of things such as tls versions, compression on or off etc but as my config is all within the files in the app then this new forwarder has the same config as the old windows one which talks to the indexer succesfully. Just wondering if there's any secret ssl security within that's preventing this working? I've tried regenerating the sslPassword in case it was that but no go.

Thanks.

[pdjhh]

This problem looks to have been caused by pushing hashed passwords in the apps to the new heavy forwarders. This doesn't work with hashed passwords (effecting app deployment) but you need to work around as per the following article:

http://docs.splunk.com/Documentation/Splunk/6.0.1/Security/Deploysecurepasswordsacrossmultipleserver...