Getting Data In

Force UF(6.4.5) and Deployment Server(6.2.3) to use TLS 1.2

yutaka1005
Builder

https://answers.splunk.com/answers/468642/deployment-server-flooded-with-ssl-handshake-error-1.html

By seeing answers above, I think that I should configure like below, if I want to force Deployment Server and Universal Forwarder to use TLS 1.2.

In Deployment Server

[sslConfig]
sslVersions = tls1.2,-ssl2, -ssl3

In Universal Forwarder

[sslConfig]
sslVersionsForClient = tls1.2,-ssl2, -ssl3

However, in my environment Universal Forwarder is ver 6.4.5 and Deployment Server is ver 6.2.3, and there isn't stanza sslVersionsForClient in ver 6.2.3.

First of all, is the setting above correct?
Also, even if the ver is different and there is a stanza that does not exist on other side, will it work without problems?

If someone tell me about it, I appreciate.

0 Karma
1 Solution

solarboyz1
Builder

If the stanza is not in deploymentclient.conf it uses the settings from server.conf.

View solution in original post

0 Karma

solarboyz1
Builder

I would just set sslVersions in the server.conf on both, and not worry about sslVersionsForClient.

By setting it in the server.conf, I believe it becomes the default setting for any SSL services running (management port, HEC, etc..).

0 Karma

solarboyz1
Builder

If the stanza is not in deploymentclient.conf it uses the settings from server.conf.

0 Karma

solarboyz1
Builder

So, what you should be doing on the client and server, is setting the sslversions in server.conf, if that wasn't clear in my answer

0 Karma

yutaka1005
Builder

Thank for answer!

So you means that I should set sslVersions stanza to both, and I should set sslVersionsForClient to Universal Forwarder, right?

0 Karma

yutaka1005
Builder

I could force tls1.2 to connection of Universal Forwarder and Deployment Server by setting sslVersions in server.conf of only Deployment Server.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...