Splunk-connect-for-kubernetes: Getting SSL Error?

[bearmoo-repo]

Hi,

I'm getting an ssl error when I tried to deploy splunk-connect-for-kubernets:

2019-03-21 23:10:08 +0000 [warn]: #0 failed to flush the buffer. retry_time=2 next_retry_seconds=2019-03-21 23:10:10 +0000 chunk="584a2d64117e8cc7b875c1c8eb060100" error_class=OpenSSL::SSL::SSLError error="SSL_connect returned=1 errno=0 state=SSLv3/TLS write client hello: wrong version number"
2019-03-21 23:10:08 +0000 [warn]: #0 suppressed same stacktrace
2019-03-21 23:10:10 +0000 [warn]: #0 failed to flush the buffer. retry_time=3 next_retry_seconds=2019-03-21 23:10:15 +0000 chunk="584a2d64117e8cc7b875c1c8eb060100" error_class=OpenSSL::SSL::SSLError error="SSL_connect returned=1 errno=0 state=SSLv3/TLS write client hello: wrong version number"
2019-03-21 23:10:10 +0000 [warn]: #0 suppressed same stacktrace

In global values.yaml, I have this:

global settings

global:
logLevel: info
splunk:
hec:
protocol: https
insecureSSL: False
host: splunk.example.com
token: xxx-yyyy

[matthewmodestino]

Hi bearmoo-repo!

Are you using valid certs on your HEC endpoint? If not you will want to flip insecureSSL: True.

Also can you check your Splunk HEC configuration to validate SSL is turned on in global settings?

[dtregonning]

Hi @bearmoo-repo Ive also seen this when ciphers may not be enabled on the destination Splunk side. Some more information can be found:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Security/Determineyourciphersuite
https://docs.splunk.com/Documentation/Splunk/7.2.4/Security/Ciphersuites

We will grab some more information and post here the required ciphers required for the connector to work as expected. @gp510

[bearmoo-repo]

Hi,

So I have insecureSSL: True and I'm still getting this error message:

2019-03-25 20:04:07 +0000 [warn]: #0 failed to flush the buffer. retry_time=3 next_retry_seconds=2019-03-25 20:04:11 +0000 chunk="584f0b49d0b3eaaded50b4b659467e57" error_class=OpenSSL::SSL::SSLError error="SSL_connect returned=1 errno=0 state=SSLv3/TLS write client hello: wrong version number"
2019-03-25 20:04:07 +0000 [warn]: #0 suppressed same stacktrace
2019-03-25 20:04:11 +0000 [error]: #0 failed to flush the buffer, and hit limit for retries. dropping all chunks in the buffer queue. retry_times=3 records=147 error_class=OpenSSL::SSL::SSLError error="SSL_connect returned=1 errno=0 state=SSLv3/TLS write client hello: wrong version number"
2019-03-25 20:04:11 +0000 [error]: #0 suppressed same stacktrace

For the cuphersuites, I whould I apply that? I did not see that in the docs?

[matthewmodestino]

I haven't had to mess with that in all the deploys I have done, but like @dtregonning said, you can check the settings on the Splunk HEC https side. What are the sslVersion settings on your HEC?

I recommend running btool on your instances that are receiving the HEC traffic. Here's what mine looks like, using the defualts:

[splunker@lab bin]$ ./splunk btool inputs list http --debug | grep sslVersions
/home/splunker/splunk/etc/apps/splunk_httpinput/default/inputs.conf       sslVersions = *,-ssl2

Or you can run it without grep and just check the defualt [http] stanza, or your specific token you are using.

Would be curious to see what you have set, or get a bit more info on what your environment setup looks like.

[bearmoo-repo]

Thanks matthewmodestino,

After running that command, I release it is a miss-configuration on my part. Please close this ticket.

-Frank

[chaitanyaphalak]

Resolved