Security

SSL Errors Encountered when using a Universal Forwarder as an Intermediate Forwarder with SSL configured

tcartsplunk
Engager

Hi

I am having some issues configuring an Intermediate Forwarder (IF) in our environment. The intermediate Forwarder is installed using a Universal Forwarder (UF) as per the document:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Configureanintermediateforwarder. Basically a host has the Universal Forwarder installed with the following inputs.conf and ouputs.conf files within the system\local directory:

++++++++++++++++++++++++++++++++++++++++++

****Inputs.conf****

[splunktcp-ssl:9997]
disabled = 0
[SSL]
serverCert = Certificate
sslPassword = Password
requireClientCert = false
sslVersions = tls1.2

[tcpout]
defaultGroup = splunkindexer
disabled = false

++++++++++++++++++++++++++++++++++++++++++

Outputs.conf

[tcpout:splunkindexer]
server = server
clientCert = Certificate
sslPassword = Password
sslVerifyServerCert = false
sslVersions = tls1.2

++++++++++++++++++++++++++++++++++++++++++

The server acting as the IF sends its logs to the Indexer as I am able to see the server in the splunk console, however I get following error messages displayed within splunkd.log on the IF in the following configurations:

sslVersions = tls1.2

With the "sslVersions = tls1.2" configured in the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:

ERROR TcpInputProc - Error encountered for connection from src=:59393. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

*sslVersions = **

If the "sslVersions = *" value is configured on the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:

ERROR TcpInputProc - Error encountered for connection from src=:57719. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

I have:

  • re-entered the certificate password and restarted the service
  • Removed the SSL config details from the inputs.conf file on the IF and no data gets forwarded

There are no problems with the configuration as displayed above if the outputs.conf file is configured as above on any other host forwarding its logs directly to the Indexer and the inputs.conf file is configured as above.

Tags (1)

bec
Explorer

I remember running into this I think. Are you sure your concatenated certificates are correctly formatted? Splunk wants the PEM cert file for the serverCert and clientCert entry to be the cert, key, and CA cert in that order (CA at end).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...