SSL to License Master?

[mikelongley]

Hi,

We run a distributed architecture in which we have organisations connecting in to our license master, and one organisation has been having trouble connecting. We checked the usual network troubleshooting and it seems fine, and I eventually found a line in the splunkd log suggesting an SSL error:

"WARN HttpListener - Socket error from X.X.X.X:Y while idling: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol"

So I didn't think license management traffic actually had an SSL option in the first place, and can't see any reference to it in Splunk's SSL documentation. Has anyone seen any similar errors or have any idea how it might be resolved?

Thanks,

Mike

[jcaceres]

unknown protocol indicates that the connecting client is sending a SSL request that the Splunk server doesn't understand.

Check your output of 

splunk btool server list --debug sslConfig

and reference the Splunk docs @isoutamo  provided for supported SSL protocols.

[isoutamo]

Hi

which splunk versions you have on LM and that client which try to connect it?

https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/SetyourSSLversion

https://docs.splunk.com/Documentation/Splunk/8.0.5/ReleaseNotes/KnownIssues

r. Ismo