Troubleshooting Bundled Python 3.9 SSL Context Initialization Failure (ASN1: NOT_ENOUGH_DATA) on Splunk Enterprise for Windows

Available Languages

Updated:October 14, 2026

Document ID:SPLK055550

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Impacted Splunk Enterprise Versions 10.0 Series: 10.0.9, 10.0.10, 10.0.11 10.2 Series: 10.2.6, 10.2.7, 10.2.8 10.4 Series: 10.4.1, 10.4.2, 10.4.3, 10.4.4 10.6 Series: 10.6.0.5Environment Specifications Operating Systems: Microsoft Windows Server 2022, Windows Server 2019, Windows 10/11 EnterpriseBundled Python Version: Python 3.9Bundled OpenSSL Versions: OpenSSL 3.0.21, OpenSSL 3.5.6Impacted Components: Python-based Add-ons (such as Splunk Add-on for Microsoft Azure), Modular Inputs, and REST API calls to the local management endpoint (127.0.0.1:8089).

Description

Python-based modular inputs fail to establish HTTPS connections to remote APIs or local loopback interfaces.

The following traceback signature is recorded in <SPLUNK_HOME>\var\log\splunk\splunkd.log or <SPLUNK_HOME>\var\log\splunk\<APP_NAME>.log:

ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4213)requests.exceptions.SSLError: HTTPSConnectionPool(host='<HOST>', port=<PORT>): Max retries exceeded

This error manifests when OpenSSL 3.0.21 or 3.5.6 fails during automated enumeration of certificates from the Windows System Certificate Stores (ROOT and CA) during ssl.create_default_context() execution.

Investigation

Verify Python and OpenSSL Version Stack: Execute the following command in PowerShell or Command Prompt to confirm the bundled OpenSSL build and test default SSL context creation:

"<SPLUNK_HOME>\bin\splunk.exe" cmd python -c "import ssl; print('OpenSSL Version:', ssl.OPENSSL_VERSION); ssl.create_default_context(); print('STATUS: SUCCESS')"

- Failure Output: The command returns ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data.
- Success Output: The command returns STATUS: SUCCESS.

Resolution

Upgrade to Fixed Maintenance Release (Recommended): Apply the appropriate maintenance release containing updated OpenSSL builds:
- 10.0 Series: Upgrade to 10.0.12 or later.
- 10.2 Series: Upgrade to 10.2.9 or later.
- 10.4 Series: Upgrade to 10.4.5 or later.
Temporary Version Rollback: If immediate upgrading is not feasible, downgrade the instance to a build preceding the OpenSSL regression:
- 10.0 Series: Roll back to version 10.0.6 (or any build in the 10.0.2–10.0.6 range).
- 10.2 Series: Roll back to version 10.2.5 or earlier.