Security

Login Failure with SDK for PHP and TLS

kmattern
Builder

I recently upgraded my Splunk installation to use TLS in order to comply with the government. Now none of my PhP scripts work. They all throw the same error which is:

exception 'Splunk_ConnectException' with message 'fopen(https://192.168.50.35:8089/services/auth/login): failed to open stream: operation failed' in C:\inetpub\wwwroot\splunk-sdk-php\Splunk\Http.php:119 Stack trace: #0 C:\inetpub\wwwroot\splunk-sdk-php\Splunk\Http.php(44): Splunk_Http->request('post', 'https://192.168...', Array, 'username=kmatte...') #1 C:\inetpub\wwwroot\splunk-sdk-php\Splunk\Context.php(93): Splunk_Http->post('https://192.168...', Array) #2 C:\inetpub\wwwroot\splunk-sdk-php\examples\XXXSearch.php(37): Splunk_Context->login() #3 {main}

After quite a bit of research I only came up with the suggestion to add the following to Http.php, which I did but to no avail. The last line is the one added.

    CURLOPT_URL => $url,
    CURLOPT_TIMEOUT => 60,  // secs
    CURLOPT_RETURNTRANSFER => TRUE,
    CURLOPT_HEADER => TRUE,
    // disable SSL certificate validation
    CURLOPT_SSL_VERIFYPEER => FALSE,
    // this line added in hopes of successful TLS login
    CURLOPT_SSL_VERIFYHOST => FALSE,

There was absolutely no change in the error. I still cannot log in. Before "upgrading" to TLS support my scripts worked perfectly. What do I need to do to get the PHP working once again?

Tags (5)
0 Karma

saltybeagle
Explorer

Depending on what version of PHP you're using, you may be using PHP sockets (fopen) or Curl. I think you're using fopen and not Curl as you're thinking.

I was using PHP 5.3.3 which used Curl, and upgraded to 5.6 for memory improvements which caused the Splunk library to switch over to sockets with fopen. I discovered that the SSL communication to the Splunk management port stopped working, because PHP 5.6 now requires SSL verification by default.

The Splunk Management port may be using the default self-signed SSL cert.
You can check by using: openssl s_client -connect 192.168.50.35:8089

Fixing it may require you to add a proper SSL cert, or modify the fopen stream context options. The fopen stream context options can be set in the Http.php file, right around here: https://github.com/splunk/splunk-sdk-php/blob/master/Splunk/Http.php#L99-L108

            'ssl' => array(
                'verify_peer' => false,
                'allow_self_signed' => true,
                'verify_peer_name' => false,
            ),

kkrishnan_splun
Splunk Employee
Splunk Employee

The above solution works like a charm. Thank you very much.

0 Karma

kmattern
Builder

You say

openssl s_client -connect 192.168.50.35:8089

How do I use that? IN a PHP script, command line?

0 Karma

aaronjones
New Member

Yes. You would open a terminal and type the above command. It will tell you if the SSL certificate is signed or unsigned.

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...