Security

streamfwd SSL decryption error (DSSL library error code -41)

ekremikizoglu
Explorer

Hi,

I am testing "App For Stream" App(6.6.1) to capture https traffics. I added pem file to keystore.db as descr. belowlink
http://docs.splunk.com/Documentation/StreamApp/6.6.1/DeployStreamApp/EnableSSLforStreamForwarder

But i am getting errors in streamfwd.log. (DSSL library error code -41)

Error line:
2016-10-17 17:37:02 WARN 11592 stream.SnifferReactor - SSL decryption error (DSSL library error code -41) (ssl) [c=yyyyyyy:61914, s=xxxxxx:8282]

Anyone can help me?

Thanks

0 Karma

ekremikizoglu
Explorer

Hi,

The issue appears to be caused by the Extended Master Secret Key extension (https://tools.ietf.org/html/rfc7627) being negotiated between the client and the server. Stream currently doesn't support this extension, so the workaround would be to turn it off on the server side.

Thanks.

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi @ekremikizoglu,

This is a rather rare error - it basically indicates a symmetric decryption failure. Do you happen to know what TLS version/cipher suite is been negotiated? (you can use Stream to track it by capturing tcp traffic and enabling ssl_cipher_name and/or ssl_cipher_id fields)

0 Karma

ekremikizoglu
Explorer

Hi,

I generated this certificate on iis server ,Self signed TLS1.2 RSA AES_256_GCM, for testing decription feature of stream app. I published website and enable ssl communication. Then i installed splunk to capture https traffic. But i got the error.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...