Getting Data In

Trying to upgrade our forwarder, why are we getting error "OpenSSL: error...handshake failure"?

sahils
New Member

Hello Team,

We tried to upgrade our Splunk Forwarder on Uslv-dapp-mon07 and mon08, but getting the error below for both Servers. Can you please help us?

Attached Screenshot.

0 Karma

woodcock
Esteemed Legend

You need these:

http://www.duanewaddle.com/quick-hit-disabling-sslv3-in-splunk/

Who: George Starcher and Duane Waddle, Defense Point Security
What: Avoid the SSLippery SSLope of Default SSL
Recording: https://splunk.webex.com/splunk/lsr.php?RCID=da90ccae281af46da9e4a3b46c076a0b
Slides: Media:SplunkTrustApril-SSLipperySlopeRevisited.pdf

And an older version here::
https://conf.splunk.com/session/2014/conf2014_DuaneWaddleGeorgeStarcher_Self_UsingTrack.pdf

ryanoconnor
Builder

What version of Splunk were you running and what are you running now?

You can disable sslv3 in web.conf. See the following page:

http://docs.splunk.com/Documentation/Splunk/6.4.1/Security/SetyourSSLversion

Another page you'll want to review is the following

http://www.splunk.com/view/SP-CAAANKE

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Looks like your screen shot was not uploaded;just paste the errors

0 Karma

sahils
New Member

It shows below error

OpenSSL: error :14077410:SSL routines:SSL23_GET_SERVER_Hello:sslv3:alert handshake failure

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.