SSL Errors Encountered when using a Universal Forwarder as an Intermediate Forwarder with SSL configured

[tcartsplunk]

Hi

I am having some issues configuring an Intermediate Forwarder (IF) in our environment. The intermediate Forwarder is installed using a Universal Forwarder (UF) as per the document:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Configureanintermediateforwarder. Basically a host has the Universal Forwarder installed with the following inputs.conf and ouputs.conf files within the system\local directory:

++++++++++++++++++++++++++++++++++++++++++

****Inputs.conf****

[splunktcp-ssl:9997]
disabled = 0
[SSL]
serverCert = Certificate
sslPassword = Password
requireClientCert = false
sslVersions = tls1.2

[tcpout]
defaultGroup = splunkindexer
disabled = false

++++++++++++++++++++++++++++++++++++++++++

Outputs.conf

[tcpout:splunkindexer]
server = server
clientCert = Certificate
sslPassword = Password
sslVerifyServerCert = false
sslVersions = tls1.2

++++++++++++++++++++++++++++++++++++++++++

The server acting as the IF sends its logs to the Indexer as I am able to see the server in the splunk console, however I get following error messages displayed within splunkd.log on the IF in the following configurations:

sslVersions = tls1.2

With the "sslVersions = tls1.2" configured in the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:

ERROR TcpInputProc - Error encountered for connection from src=:59393. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

*sslVersions = **

If the "sslVersions = *" value is configured on the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:

ERROR TcpInputProc - Error encountered for connection from src=:57719. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

I have:

• re-entered the certificate password and restarted the service
  
• Removed the SSL config details from the inputs.conf file on the IF and no data gets forwarded

There are no problems with the configuration as displayed above if the outputs.conf file is configured as above on any other host forwarding its logs directly to the Indexer and the inputs.conf file is configured as above.

[bec]

I remember running into this I think. Are you sure your concatenated certificates are correctly formatted? Splunk wants the PEM cert file for the serverCert and clientCert entry to be the cert, key, and CA cert in that order (CA at end).