Splunk 6.6.2 error sending alert email "ERROR:root:EOF occurred in violation of protocol (_ssl.c:676)"

[marksnelling]

I just upgraded from Splunk 6.5.2 to 6.6.2 and now the emailing of alerts when using STARTTLS is broken. Looking at the splunkd.log file I can see the error ERROR:root:EOF occurred in violation of protocol (_ssl.c:676).

Email works correctly if I disable the SMTP STARTTLS option in email settings which is less than ideal.

[appdev84]

It looks like there is a known issue when upgrading Splunk 6.5.x to Splunk 6.6.2.

http://docs.splunk.com/Documentation/Splunk/6.6.2/ReleaseNotes/KnownIssues#Upgrade_Issues

I followed the guide and added $SPLUNK_HOME/etc/system/local/alert_actions.conf and added

[email]
sslVersions = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I then restarted the server and it was emailing again.