Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20 (solution)

lim2 — Sat, 03 Sep 2022 12:23:56 GMT

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20

After support tickets with Zoom and Splunk here are some experience would like to share.
Using signed ssl certificates private or internal CA did not work.
It seems that I had to use a certificate signed a commercial CA like Entrust.
If you want to chain your ssl certificate with Entrust root and intermediate certificates, please ensure that the certificates are in the order as follows after running the command:
openssl crl2pkcs7 -nocrl -certfile yoursslcertificate.entrust.pem | openssl pkcs7 -print_certs -noout
Or you could just include the commercially issued ssl certificate without the root and intermediate certificates.

subject=/C=US/ST=STATE/L=CITY/O=ORG, Inc./CN=mycompany.com issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

If all works after restarting Splunk, running the netstat -nap |grep 9997 will show the following connections from Zoom ip addresses and you would see logs under the sourcetype=zoom:webhook

tcp 0 0 0.0.0.0:4443 0.0.0.0:* LISTEN 25849/python3.7 tcp 0 0 10.#.#.#:4443 3.235.82.171:41101 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:58497 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:54514 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:48513 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:53006 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:55259 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:46028 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:52837 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.172:7527 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.82.171:12934 TIME_WAIT - tcp 0 0 10.#.#.#:4443 3.235.83.101:32088 TIME_WAIT -

topic Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20 (solution) in All Apps and Add-ons

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20 (solution)