SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

[AlexK]

Hi all,

We have an excisting index cluster which was installed with version 6.x and gradually upgraded to version 8.1.3.

In the proces of adding two new Heavy forwarders we can not get the HF to properly communicate with the index cluster. The HF are fresh installations using the lates t8.1.3 package.

We get the error as shown in the subject. Since we do not use SSL where a bit lost with regards to this message. 

[isoutamo]

Hi

Your HF's is probably using e.g. indexer discovery or those are configured by DS. In those cases splunkd are using SSL/TLS even your indexing traffic is plain S2S. You should check that you have same SSL configs on both side HF vs DS vs. CM vs. Indexers. 

There are quite many articles in answer where you could get more hints if needed. Just query from google with

site:community.splunk.com SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

and you get those.

r. Ismo