After Upgrading to Splunk Light 6.6 last week I did not get any emails from my splunk server. In python.log I see the following errors:
ERROR sendemail:443 - [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:676) while sending mail
I am connecting to the mail server over port 587 using "Enable TLS" without username.
Any ideas whats going wrong?
Please see the notes for issue SPL-138647 which contains the steps for figuring out what SSL/TLS versions and cipher suites your e-mail server supports:
If security is not a concern, you can also just revert back to the previous release settings:
sslVersions = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH
View solution in original post
Please see SPL-138647 in the release notes to determine what SSL/TLS version and cipher suites your e-mail server supports:
Alternatively, if security is not a concern, you can also revert to the 6.5.x configuration:
Do you have the Admin role in Splunk Light, or the User role?