How to allow TLSv1.1 with AES256-SHA in HEC with Splunk 8?

[yuanliu]

Splunk 8's HEC defaults to TLSv1.2 only.  But I have a need to allow TLSv1.1 with AES256-SHA in order for puppetserver 2.7.0 to connect.

So far, I figured that in order to effect HEC protocols, I must also alter $SPLUNKE_HOME/etc/system/local/web.conf.  So I changed sslVersion to *, and made sure that AES256-SHA is in cipherSuite.  I can verify that TLSv1.1 is allowed when using openssl command line to connect; the same code in Puppet's splunk_hec reporter is also able to connect via TLSv1.1 when invoked from native Ruby (Ruby 2.0).  But I cannot externally examine the exact cipher used even with Wireshark.

Anyway, even with this setup on Splunk's side, I still get "ssl3_get_client_hello:no shared cipher" when puppetserver tries to connect.  The difference is that puppetserver 2.7.0 runs in outdated JRuby that uses Ruby 1.9.  Nevertheless, https://ask.puppet.com/question/33316/puppet-https-connection-using-latest-tls-version-and-cipher-su... states "the only way to get puppet to successfully connect is to enable the AES256-SHA cipher."  So, I would expect the combination to be successful.

What other things do I need to change?

[yuanliu · Accepted solution]

Contrary to results from my numerous previous experiments, the final configuration is rather simple (and less compromising than I initially feared): Add AES256-SHA to cipherSuite in $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf.

(In other words, web.conf doesn't affect HEC, after all.  The real problem with puppetserver 2.7.0 is SERVER-2036 which was fixed in Server 5.5.  I'll describe a workaround in the other post about splunk_hec.)