Setting requireClientCert = true in server.conf prevents the CLI from communicating with splunkd

[hexx]

In server.conf.spec, it is indicated that requireClientCert = true can be set to require HTTPS clients connecting to splunkd to present a certificate signed by the CA whose public certificate we define in caCertFile in server.conf.spec :

requireClientCert = [true|false]

Requires that any HTTPS client that connects to splunkds internal HTTPS server has a certificate that was signed by our certificate authority.
Used by distributed search: Splunk indexing instances must be authenticated to connect to another splunk indexing instance.
Used by distributed deployment: The deployment server requires that deployment clients are authenticated before allowing them to poll for new configurations/applications.
If true, a client can connect ONLY if a certificate created by our certificate authority was used on that client.
Default is false

However, this appears to break communication between the CLI and splunkd :

[root@hostname local]# splunk login
Splunk username: admin
Password:
Couldn't get auth token: Couldn't complete HTTP request:
error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

From web_service.log:

SplunkdConnectionException: Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure',)
2011-04-14 14:19:22,335 ERROR [4da73aaa551ece7d0] startup:52 - Unable to read in product version information; Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure',)
2011-04-14 14:19:22,336 ERROR [4da73aaa551ece7d0] decorators:361 - Splunkd daemon is not responding: ('[Errno 1] _ssl.c:485:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure',)

[abhullar_splunk]

There is a new bug filed as bug SPL-122988 for version 6.4.1 of Splunk

[psow_splunk]

Just an update that the issue on the communication being broken when authenticating the client cert has been fixed on Splunk 5.X

[kenson]

The best workaround for this issue I've found is to proxy your request through socat like so:

socat TCP-LISTEN:1212,fork,reuseaddr  OPENSSL-CONNECT:somesplunk-instance:8089,verify=0,cert=somecert.pem

And then calling splunk like so:

./bin/splunk list monitor -uri http://localhost:1212

[hexx]

Nice work-around! Thank you for sharing it.

[hexx · Accepted solution]

Because the CLI cannot be configured to present an SSL certificate, setting requireClientCert = true in server.conf does indeed break its ability to communicate with splunkd.

As of Splunk 4.3, this has been filed as bug SPL-47585.