topic Re: SSL Certificate issue in Splunk Enterprise

SSL Certificate issue

AntonyPriwin — Thu, 02 Dec 2021 13:26:07 GMT

We have a situation, while trying to post a request to a external api from java script, we are getting timeout error.

While trying to hit the same url through curl we are getting the below ssl cert error.

"curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above. "

I have attached the error snip and the related JS here.

JS snippet:

const userAction = async (pid) => {
const url='https://xyz.com:443/PID?ppid='+pid;
const response = await fetch(url,{ method: 'POST',mode: 'cors'})
.then(response => console.log(response))
.then(xmlString => console.log($.parseXML(xmlString)) )
.catch(error => console.log(error))

has anyone come across the above issue, any help is appreciated

Thanks.

Re: SSL Certificate issue

Gr0und_Z3r0 — Thu, 02 Dec 2021 13:31:43 GMT

Has the instance being whitelisted to allow traffic from your Splunk instance or from where the request is generated /triggered?

Re: SSL Certificate issue

isoutamo — Thu, 02 Dec 2021 14:23:31 GMT

you are probably using your own certificates or splunk's generated (without any intermediate certs). Then your client code is expecting that CA which has signed that code must be trusted.

You could test this with curl -v https://zyx.... vs. curl -vk https://xyz.... The first own told that it cannot verify certificate and second one works.

There are two options for you.

Switch to official certificates on splunk side or if you have VIP before it then you can add it there.
Add to your code parameters which don't require that CA is known (less secure option)
If you are using private certs then add your CA as trusted for your "code"/system

r. Ismo

Re: SSL Certificate issue

AntonyPriwin — Wed, 08 Dec 2021 15:28:17 GMT

Hi,

Added intermediate cert but getting below error

curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to xyz.com:443

Thanks in advance