Getting Data In

Can default certificate be used for communication between universal forwarder and heavy forwarder in Splunk cloud?

New Member

I am pretty new to splunk. We are implementing heavy forwarder on EC2 instance which receives the data from UF and forwards to splunk cloud. I am trying to test the data forwarding by configuring default splunk certs on HF inputs.conf and UF outputs.conf . But I am seeing below errors on the HF. Any pointers would be most appreciated.

WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read server certificate B', alert_description='unknown CA'. 

ERROR TcpOutputFd - Connection to failed. sock_error = 0. SSL Error = error:SSL routines:ssl3_get_server_certificate:certificate verify failed - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.
0 Karma

Splunk Employee
Splunk Employee

Hi @Amogh88

To forward data from HF to Splunk cloud we have to add SSL config in outputs.conf of HF to communicate with splunkcloud instances as like below :

sslCertPath = *********(Path of cert)
sslRootCAPath = ******** (Path of RootCA)
sslPassword = *******

sslCommonNameToCheck = {certname}
sslVerifyServerCert = true
useClientSSLCompression = true

Hope this will help you to resolve your issue.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!