Login Failure with SDK for PHP and TLS


I recently upgraded my Splunk installation to use TLS in order to comply with the government. Now none of my PhP scripts work. They all throw the same error which is:

exception 'Splunk_ConnectException' with message 'fopen( failed to open stream: operation failed' in C:\inetpub\wwwroot\splunk-sdk-php\Splunk\Http.php:119 Stack trace: #0 C:\inetpub\wwwroot\splunk-sdk-php\Splunk\Http.php(44): Splunk_Http->request('post', 'https://192.168...', Array, 'username=kmatte...') #1 C:\inetpub\wwwroot\splunk-sdk-php\Splunk\Context.php(93): Splunk_Http->post('https://192.168...', Array) #2 C:\inetpub\wwwroot\splunk-sdk-php\examples\XXXSearch.php(37): Splunk_Context->login() #3 {main}

After quite a bit of research I only came up with the suggestion to add the following to Http.php, which I did but to no avail. The last line is the one added.

    CURLOPT_URL => $url,
    CURLOPT_TIMEOUT => 60,  // secs
    // disable SSL certificate validation
    // this line added in hopes of successful TLS login

There was absolutely no change in the error. I still cannot log in. Before "upgrading" to TLS support my scripts worked perfectly. What do I need to do to get the PHP working once again?

Tags (5)
0 Karma


Depending on what version of PHP you're using, you may be using PHP sockets (fopen) or Curl. I think you're using fopen and not Curl as you're thinking.

I was using PHP 5.3.3 which used Curl, and upgraded to 5.6 for memory improvements which caused the Splunk library to switch over to sockets with fopen. I discovered that the SSL communication to the Splunk management port stopped working, because PHP 5.6 now requires SSL verification by default.

The Splunk Management port may be using the default self-signed SSL cert.
You can check by using: openssl s_client -connect

Fixing it may require you to add a proper SSL cert, or modify the fopen stream context options. The fopen stream context options can be set in the Http.php file, right around here:

            'ssl' => array(
                'verify_peer' => false,
                'allow_self_signed' => true,
                'verify_peer_name' => false,

Splunk Employee
Splunk Employee

The above solution works like a charm. Thank you very much.

0 Karma


You say

openssl s_client -connect

How do I use that? IN a PHP script, command line?

0 Karma

New Member

Yes. You would open a terminal and type the above command. It will tell you if the SSL certificate is signed or unsigned.

0 Karma
Get Updates on the Splunk Community!

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW! Every day the list of sources Admins are responsible for gets bigger and bigger, often making ...