Symptom

A Cribl Stream Kafka Source configured to consume data from ServiceNow fails to connect to the seed broker and returns the following error:

Failed to connect to seed broker, trying another broker from the list:
Connection error: 20204C09BFF10000:error:0A000416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1605:SSL alert number 46

Environment

• Product: Cribl Stream

• Source: Kafka

• Integration: ServiceNow Log Export Service (LES)

• Transport: Hermes Messaging Service using Apache Kafka

• Authentication: TLS client certificate

• Certificate format provided by ServiceNow: PKCS#12 (.p12)

Resolution

ServiceNow provides the required certificates in a ZIP file containing keystore.p12 and truststore.p12. Extract the certificates and private key into PEM files before adding them to Cribl Stream.

1. Extract the client private key from keystore.p12:

openssl pkcs12 -in keystore.p12 -nocerts -nodes -out client-key.pem

2. Extract the client certificate from keystore.p12:

openssl pkcs12 -in keystore.p12 -clcerts -nokeys -out client-cert.pem

3. Extract the complete client certificate chain from keystore.p12:

openssl pkcs12 -in keystore.p12 -nokeys -out client-cert-chain.pem

4. Extract the CA certificate chain from truststore.p12:

openssl pkcs12 -in truststore.p12 -nokeys -out ca-chain.pem

5. Create a new certificate in Cribl Stream using the extracted PEM content:

   • Private key: Contents of client-key.pem

   • Certificate: Contents of client-cert-chain.pem

   • CA certificate: Contents of ca-chain.pem

   • Passphrase: Enter the applicable certificate passphrase, if required

6. Configure the Kafka Source to use the new certificate.

7. Set the Consumer Group ID using the following format:

snc.<customer-instance>.cribl

For example:

snc.cribldev.cribl

The customer instance value is provided by ServiceNow.

8. Set the topic using the following format:

snc.<customer-instance>.sn_loganalytics.sys_audit

For example:

snc.cribldev.sn_loganalytics.sys_audit

9. Save and enable the Source, then verify that it connects successfully and begins receiving events.

Cause

The ServiceNow certificate package contains PKCS#12 keystore and truststore files. These files cannot be copied directly into the PEM-based certificate fields used by the Cribl Stream Kafka Source.

The connection fails when the client private key, client certificate chain, or trusted CA chain is missing or incorrectly configured. The remote broker rejects the TLS certificate and returns SSL alert 46, certificate unknown.

Additional Information

• Protect client-key.pem because it contains an unencrypted private key.

• Remove locally extracted certificate files when they are no longer needed.

• Confirm that the Consumer Group ID and topic use the exact customer instance identifier supplied by ServiceNow.

• For more information, see ServiceNow’s Set up a secure connection documentation.