SOAR - ES pairing failed with SSLV3_ALERT_HANDSHAKE_FAILURE

Applicability

Description

Followed the document Pair Splunk Enterprise Security with Splunk SOAR | Splunk Docs and uploaded SOAR on-prem SSL self-sign certificate to Splunk Enterprise Security on-prem. The pairing still got error:

SOAR REST Exception: HTTPSConnectionPool(host='<SOAR FQDN or IP>', port=443): Max retries exceeded with url: /rest/version (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1161)')))

Investigation

SOAR on-prem 7.0.0 FIP enabled:

Red Hat Enterprise Linux release 9.7 (Plow)
OpenSSL 3.5.1 1 Jul 2025 (Library: OpenSSL 3.5.1 1 Jul 2025)

Search head (ES) 8.2.2, Splunk 9.4.3, FIPS enabled:

Red Hat Enterprise Linux 9.6 (Plow)
OpenSSL 3.2.2 4 Jun 2024 (Library: OpenSSL 3.2.2 4 Jun 2024)

The OpenSSL command returned connected but pairing failed.

openssl s_client -connect <hostname>:<port>

There is no customized setting in OpenSSL in /etc/crypto-policies/back-ends/openssl.config.

Resolution

When testing in similar environment with Splunk Enterprise 10.0.2 and the pairing worked. Splunk version 10 depreciates the lower TLS versions like SSLV3, TLS1.0, and TLS1.1 and forces TLS1.2.