What protocol is used for the SSL connection between the Splunk forwarder and index?

[Meterman]

I would like to know what protocols / ciphers are used for the ssl connection. Is it SSLv3, TLS1.0, TLS1.1 or TLS1.2?
Is that determined by the OS or Splunk?

[hunters_splunk · Accepted solution]

Hi Meterman,

The default SSL version is tls1.2, but these versions are all supported: "ssl3", "tls1.0", "tls1.1", and "tls1.2".

You can specify the SSL version in authentication.conf and server.conf

authentication.conf

sslVersions = <versions_list>
* OPTIONAL
* Comma-separated list of SSL versions to support.
* The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2"
* If not set, defaults to the setting in server.conf.

server.conf

sslVersions = <versions_list>
* OPTIONAL
* Comma-separated list of SSL versions to support.
* The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2"
* If not set, defaults to the setting in server.conf.

Hope this helps. Thanks!
Hunter

[hunters_splunk]

server.conf
sslVersions =
* Comma-separated list of SSL versions to connect to 'url' (https://apps.splunk.com).
* The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2".
* The special version "*" selects all supported versions. The version "tls"
selects all versions tls1.0 or newer.
* If a version is prefixed with "-" it is removed from the list.
* SSLv2 is always disabled; "-ssl2" is accepted in the version list but does nothing.
* When configured in FIPS mode, ssl3 is always disabled regardless
of this configuration.
* Defaults to "tls1.2".

[Meterman]

Thankyou very much. That is great information!