topic Re: Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue in All Apps and Add-ons

Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue

abalogh_splunk — Tue, 29 Sep 2020 15:43:31 GMT

Hi,
We are still getting errors even though we have added our Root CA and Intermediate CA to Red Hat's local certificate db.

We are using Splunk_TA_microsoft-cloudservices v2.03 on Splunk Enterprise 6.6.2 running on Red Hat 7.4

Root CA added to /etc/pki/ca-trust/source/anchors/company_root.pem (base64 encoded)
Intermediate CA added to /etc/pki/ca-trust/source/anchors/company_int.pem (base64 encoded)

update-ca-trust

AuthenticationError: , SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:676)

Re: Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue

abalogh_splunk — Tue, 29 Sep 2020 15:43:34 GMT

I will answer my own question because this was not documented. I had to read code.

The correct certificate file to update with your Root CA and intermediate CA (which we need since we are inspecting SSL traffic) was:

Splunk_TA_microsoft-cloudservices/bin/splunktamscs/certify/cacert.pem

We appended the /etc/pki/tls/certs/ca-bundle.crt to Splunk_TA_microsoft-cloudservices/bin/splunktamscs/certify/cacert.pem and started working.

Re: Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue

laurie_gellatly — Mon, 08 Mar 2021 00:13:03 GMT

This fixed the problem that I was facing. Thanks for posting.

Re: Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue

season88481 — Fri, 16 Jul 2021 04:02:14 GMT

We have the similar issue too. So appending our own CA cert to the bottom of the cacert.pem fixed our issue.

Please note at our version (4.1.3) the cacert.pem is located at $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/lib/certifi/ folder. if you cannot find it at these folders, perhaps use any "find" command would do the trick.

I think Splunk should document this workaround at the doc, as it is very common that companies would use their own company signed certificate for the Azure management endpoint.