topic Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ? in All Apps and Add-ons

" Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

MarkSplunker — Tue, 29 Sep 2020 16:22:09 GMT

Following the instructions to "Troubleshoot the Splunk Add-on for Tenable" at https://docs.splunk.com/Documentation/AddOns/released/Nessus/Troubleshoot I copied the PEM file from Firefox (with its default .crt extension) over to $SPLUNK_HOME/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/ and renamed it to cacerts.txt. I'm still getting the same error. One of the forums suggested exporting from Firefox 'with chain', so I tried that as well and it failed. Restarting Splunk each time still did not fix the problem. This is a single standalone Splunk installation. Any thoughts? Thanks.

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

nickhills — Sat, 21 Oct 2017 11:18:14 GMT

If you have just upgraded from 5.1.1 - to 5.1.2 the certifcate behaviour has changed, and whilst you 'can' to do this - this does not mean that its a good idea.

In 5.1.1 you would get a warning message in tenable:sc:log advising you that the cert (chain) is not valid.
In 5.1,2 this is a hard stop, and collection will not occur.

To restore the 5.1.1 functionality

edit (create) $SPLUNK_HOME/Splunk_TA_nessus/local/nessus.conf and add:

[tenable_sc_settings]
disable_ssl_certificate_validation = 1

restart your heavy forwarder.

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

nickhills — Sat, 21 Oct 2017 11:28:07 GMT

Its worth checking what firefox thinks of the Cert state?

If the cert is self signed, then exporting the cert and chain should do the job for you, however, if the certificate on SC has expired then you will need a date valid cert first, and then export the cert.

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

MarkSplunker — Thu, 26 Oct 2017 01:49:18 GMT

Hi, Nick*.

Thanks for responding. Firefox thinks it's ok. That's where I started: connecting to SC, then exporting the chain. The directions implied that I simply copy the file into the proper directory and rename it, but if they mean something other than that please let me know.

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

MarkSplunker — Tue, 29 Sep 2020 16:28:49 GMT

Hello again Nick*.

I tried your second approach and it is working. Thanks so much!
BTW, on Windows, the path for nessus.conf is C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\local\nessus.conf.

I haven't sniffed the wire yet to see if traffic is NOT encrypted as a result of this tweak, but will check tomorrow. Thanks again.

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

nickhills — Thu, 26 Oct 2017 04:46:19 GMT

It will still be SSL traffic, but Splunk will just ignore the certificate trust warning, and proceed as if the cert was verified as valid.

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

jim_mulder_CI — Tue, 07 Nov 2017 22:39:32 GMT

I'm having trouble with this on a fresh install of 5.1.2, too. We run our own RootCA, and I've tried adding the root and intermediate (and certificate) to no avail. Tried creating the nessus.conf file, but still get a cert warning and no data.

Anybody have other ideas?

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

jim_mulder_CI — Tue, 07 Nov 2017 23:06:28 GMT

Nevermind. Stupid hidden file extensions on Windows...

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

nagendra0911 — Wed, 21 Mar 2018 17:24:28 GMT

hi all,i tried above all steps but same ssl certificate error still present,my security center v is 5.6.1

Re: " Splunk Add-on for Tenable:" How can I resolve basic SSL connection failure throwing error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed" ?

thambisetty — Tue, 29 Sep 2020 19:12:47 GMT

@nagendra0911,
try adding below to inputs.conf in local folder.
disable_ssl_certificate_validation = true