Security

SSL Errors Encountered when using a Universal Forwarder as an Intermediate Forwarder with SSL configured

tcartsplunk
Engager

Hi

I am having some issues configuring an Intermediate Forwarder (IF) in our environment. The intermediate Forwarder is installed using a Universal Forwarder (UF) as per the document:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Configureanintermediateforwarder. Basically a host has the Universal Forwarder installed with the following inputs.conf and ouputs.conf files within the system\local directory:

++++++++++++++++++++++++++++++++++++++++++

****Inputs.conf****

[splunktcp-ssl:9997]
disabled = 0
[SSL]
serverCert = Certificate
sslPassword = Password
requireClientCert = false
sslVersions = tls1.2

[tcpout]
defaultGroup = splunkindexer
disabled = false

++++++++++++++++++++++++++++++++++++++++++

Outputs.conf

[tcpout:splunkindexer]
server = server
clientCert = Certificate
sslPassword = Password
sslVerifyServerCert = false
sslVersions = tls1.2

++++++++++++++++++++++++++++++++++++++++++

The server acting as the IF sends its logs to the Indexer as I am able to see the server in the splunk console, however I get following error messages displayed within splunkd.log on the IF in the following configurations:

sslVersions = tls1.2

With the "sslVersions = tls1.2" configured in the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:

ERROR TcpInputProc - Error encountered for connection from src=:59393. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

*sslVersions = **

If the "sslVersions = *" value is configured on the inputs.conf on the receiving Indexer, the inputs.conf and outputs.conf on the IF and outputs.conf on the UFs forwarding the data to the IF, I get the following error:

ERROR TcpInputProc - Error encountered for connection from src=:57719. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol

I have:

  • re-entered the certificate password and restarted the service
  • Removed the SSL config details from the inputs.conf file on the IF and no data gets forwarded

There are no problems with the configuration as displayed above if the outputs.conf file is configured as above on any other host forwarding its logs directly to the Indexer and the inputs.conf file is configured as above.

Tags (1)

bec
Explorer

I remember running into this I think. Are you sure your concatenated certificates are correctly formatted? Splunk wants the PEM cert file for the serverCert and clientCert entry to be the cert, key, and CA cert in that order (CA at end).

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...