SSL Error between an UF and a Heavy Forwarder with same version 7.0.5

[ESMaletMa]

Hi

I have a new UF (source) to send data to a HF (destination). Both are 7.0.5.

In the UF I have this error when I start it:

01-10-2019 11:57:57.163 +0100 ERROR TcpOutputFd - Read error. Connection reset by peer

My outputs.conf is this one:

[tcpout:to_prod_forwarder]
server=51.162.0.209:9995
useSSL = true

[SSL]
clientCert = /opt/splunkforwarder/etc/auth/server.pem
sslVersions = *

In the destination I have this error:

01-10-2019 10:57:57.196 +0000 ERROR TcpInputProc - Error encountered for connection from src=91.209.84.9:31318. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

My inputs.conf (I have other sources sending logs with SSL with no problem, I cannot touch this inputs.conf)

[splunktcp-ssl://:9995]
index = web
sourcetype = webserver

[SSL]
serverCert = /opt/splunk/etc/certs/shf.pem
requireClientCert = false
sslPassword = pass...
allowSslRenegotiation = false

I read that this error hapened between Splunk versions 6.x with 7.x, but not with the same versions.

In the UF i tried to exclude ssl versions... only enabling tls but with no luck...

sslVersions = tls1.1, tls1.2

Any idea what is happening?
Thank you very much in advance

[hdbang_splunk · Accepted solution]

Hello,

The default of allowSslRenegotiation is true while your inputs.conf has false.

allowSslRenegotiation = false

According to SPEC, that would causes connectative issue.

allowSslRenegotiation = true|false
* In the SSL protocol, a client may request renegotiation of the connection
settings from time to time.
* Setting this to false causes the server to reject all renegotiation
attempts, which breaks the connection.
* This limits the amount of CPU a single TCP connection can use, but it can
cause connectivity problems, especially for long-lived connections.
* Defaults to true.

If this is not the case, kindly contact Splunk support and have the configuration and logs analyzed.

[ESMaletMa]

thank you! I will try to change this config

[p_gurav]

Try putting your serverCert in $SPLUNK_HOME/etc/auth/ folder.

Also go through below link:

https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/ConfigureSplunkforwardingtousesignedcert...