how do i know if it is Splunk SSL Certificates or the IIS SSL certificates expired

[zliu]

how do i know if it is Splunk SSL Certificates or the IIS SSL certificates expired

Error in splunkd.log, I saw:

08-29-2011 07:57:52.571 ERROR TcpInputProc - Error encountered for
connection from host=xxx.xxx.xxxxx.xxxx, ip=xxx.xx.xx.xx.
error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate
expired

[MuS]

Hi Splunker_J

your error code is an openSSL error message and points usually to the local instance not a remote one. Since TcpInputProc reports this in splunkd.log my conclusion would be that your Splunk SSL cert has expired.

I'm not the expert on Splunk and SSL, I'm just ready your provided log and did some research.

kind regards

[mzorzi]

If you are connecting through a reverse proxy and IIS certificate is expired I believe you shouldn't even come so far to talk to splunkd. Since the error is recorded by splunkd, I believe it is Splunk certificate which is expired