Splunk 6.6.2 error sending alert email "ERROR:root:EOF occurred in violation of protocol (_ssl.c:676)"


I just upgraded from Splunk 6.5.2 to 6.6.2 and now the emailing of alerts when using STARTTLS is broken. Looking at the splunkd.log file I can see the error ERROR:root:EOF occurred in violation of protocol (_ssl.c:676).

Email works correctly if I disable the SMTP STARTTLS option in email settings which is less than ideal.

0 Karma


It looks like there is a known issue when upgrading Splunk 6.5.x to Splunk 6.6.2.

I followed the guide and added $SPLUNKHOME/etc/system/local/alertactions.conf and added

sslVersions = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I then restarted the server and it was emailing again.