ERROR AesGcm - AES-GCM Decryption failed!

Applicability

Splunk Enterprise Deployment Server

Description

The below errors were observed - 

+0000 ERROR AesGcm [7361 TcpChannelThread] - Text decryption - error in finalizing: No errors in queue
+0000 ERROR AesGcm [7361 TcpChannelThread] - AES-GCM Decryption failed!
+0000 ERROR Crypto [7361 TcpChannelThread] - Decryption operation failed: AES-GCM Decryption failed!
+0000 ERROR AesGcm [7361 TcpChannelThread] - Text decryption - error in finalizing: No errors in queue
+0000 ERROR AesGcm [7361 TcpChannelThread] - AES-GCM Decryption failed!
+0000 ERROR Crypto [7361 TcpChannelThread] - Decryption operation failed: AES-GCM Decryption failed!
+0000 ERROR AesGcm [7352 TcpChannelThread] - Text decryption - error in finalizing: No errors in queue

Investigation

1. Commented out the pass4Symmkey in /opt/splunk/etc/system/local/server.conf -
 

[general]
pass4Symmkey = $........

2. Changed the sslPassword attribute in /opt/splunk/etc/system/local/server.conf to clear text -

[sslConfig]
sslPassword = password

3. After this, restarted the DS and observed if the error messages showed up or not.

4. It did not work, as the error messages kept coming back.
 

Resolution

- It was observed after upgrading the DS to 9.0, these errors were populating on the DS and other components (Indexers, Search Heads) as well.

- There was a configuration file which got pushed to all the components and resulted in the error messages.

- Ran this command on the DS - 

$SPLUNK_HOME/bin/splunk show-decrypted --value <whatever_encrypted_key_in_any_conf_file>.

- Observed that for two add-ons - Splunk_TA_AWS & Splunk_TA_O365, it was returning the error message.

- Navigated to  /opt/splunk/etc/apps/Splunk_TA_aws/local/passwords.conf.

- Validated the encrypted password present for the app and typed the command to show decrypted password -

./splunk show-decrypted --value <whatever_encrypted_key_in_any_conf_file>.

• It was returning a decryption error and was unable to decrypt the cipherText.
  
  - Noticed the same when navigating to /opt/splunk/etc/apps/splunk_ta_O365/local/passwords.conf to show the decrypted password. It was returning the same error.
  
  Workaround - 
  
  Upgraded Splunk_TA_AWS and Splunk_TA_O365 to the latest versions and after that, the errors were not showing up anymore.

 

- If encrypted passwords can be decrypted without issue using the above command, the file passwords.conf may not have issue. Then find the other configuration files for all the encrypted password (begin with "$" in conf files. (e.g. pass4Symmkey, sslPassword, etc). The below command can be used in Linux. As usually, encrypted strings in Splunk configuration files start with '$' and often end with '=='

sudo grep -Rin '\$[0-9]\$[A-Za-z0-9+/=]\+==$' $SPLUNK_HOME/etc --include=\*.conf

Related Links

Getting decryption failed errors
Forgot Pass4symmKey

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release