Security

how do i know if it is Splunk SSL Certificates or the IIS SSL certificates expired

Splunk Employee
Splunk Employee

how do i know if it is Splunk SSL Certificates or the IIS SSL certificates expired

Error in splunkd.log, I saw:

08-29-2011 07:57:52.571 ERROR TcpInputProc - Error encountered for
connection from host=xxx.xxx.xxxxx.xxxx, ip=xxx.xx.xx.xx.
error:14094415:SSL routines:SSL3READBYTES:sslv3 alert certificate
expired

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Hi Splunker_J

your error code is an openSSL error message and points usually to the local instance not a remote one. Since TcpInputProc reports this in splunkd.log my conclusion would be that your Splunk SSL cert has expired.

I'm not the expert on Splunk and SSL, I'm just ready your provided log and did some research.

kind regards

Splunk Employee
Splunk Employee

If you are connecting through a reverse proxy and IIS certificate is expired I believe you shouldn't even come so far to talk to splunkd. Since the error is recorded by splunkd, I believe it is Splunk certificate which is expired