Security

Splunk 6.3 forwarder is not sending data using SSL however Splunk 6.6 is working fine with the same settings

reach2tushar
Explorer

Splunk 6.3 forwarder is not sending data using SSL while Splunk 6.6 is working fine with the same settings.

Following entries are added in outputs.conf on forwarder:
[tcpout]
defaultGroup =Splunk_Indexers

[tcpout:Splunk_Indexers]
disabled = false
server = servername:9997
compressed = false
sslRootCAPath = "splunk-home"\etc\auth\NewAuth\CARoot.crt
sslCertPath = "splunk-home"\etc\auth\NewAuth\servercert.pem

Following entries are added in inputs.conf on indexer:
[splunktcp-ssl://9997]
connection_host = ip

[SSL]
compressed = false
password = $5SD$==
requireClientCert = false
rootCA = "splunk-home"\etc\auth\NewAuth\CARoot.crt
serverCert = "splunk-home"\etc\auth\NewAuth\servercert.pem

Can please help to fix this issue as the above settings are working fine in Splunk 6.6 forwarder but giving following error in splunkd.log on Splunk 6.3 forwarder:
"Connection to host=servername:9997 failed. sock_error = 0. SSL Error = error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed"

Tags (2)
0 Karma

cameronjust
Path Finder

I'm seeing the same problems. Likely due to cipher issues with certain ciphers being deprecated.

Even the if mentioned here for 6.0 and 6.1 does not help.

http://docs.splunk.com/Documentation/Splunk/6.6.3/ReleaseNotes/KnownIssues#Data_input_issues

0 Karma

n028167
New Member

Check your underlying cert on 6.3. Believe this default expired last year. You'll want 6.4 or higher if using default cert.

0 Karma

reach2tushar
Explorer

Hi, We are using our own CA certificates in both 6.3 and 6.6. Could you please suggest?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...