How can I force a specific ECDHE cipher to communicate with the Splunk web interface?

[bpaul_splunk]

The cipherSuite parameter desired has been configured in $SPLUNK_HOME/etc/system/local/web.conf, but when I restart Splunk, the web interface is not available. I also see the following warning messages in splunkd.log.

WARN  HttpListener - Socket error from 127.0.0.1 while idling: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher

How can I get this to work?

[bpaul_splunk]

By default, Splunk uses TLSv1+HIGH:@STRENGTH. The ciphers used with this setting can be retrieved by running the following command.

$SPLUNK_HOME/etc/splunk cmd openssl ciphers -v "TLSv1+HIGH:@STRENGTH"

The ciphers used to communicate with the Splunk web interface may also be configured in your web.conf file. If you choose, to use an ECDHE cipher you must provide the elliptic curve name to be used. The option for this as stated in the splunk specification files is:

ecdhCurveName = <string>
   * ECDH curve to use for ECDH key negotiation
   * We only support named curves specified by their SHORT name. 
   * (see struct ASN1_OBJECT in asn1.h)
   * The list of valid named curves by their short/long names
   * can be obtained by executing this command:
   * $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves
   * Default is empty string.

One commonly used setting is the following.

ecdhCurveName = prime256v1

NOTE: Since Splunk web, and the Splunk daemon communicate with each other, you need to make sure that whichever cipherSuite and ecdhCurveName are set in web.conf will also be supported by the cipherSuite parameters used in server.conf.