topic Re: Error while installing SOAR version 6.4.1 in Splunk SOAR

Error while installing SOAR version 6.4.1

SOAR_098 — Thu, 06 Nov 2025 22:13:35 GMT

Running a clean install on Amazon Linux 2023. Followed the instructions on the install page for the soar-prepare-system command, not running clustered, default options for everything, created the phantom user with no trouble. /opt/splunk-soar is owned by phantom, ran the soar-install command as phantom, got through everything fine until the GitRepos step, hit this error:

"INSTALL: GitRepos

Configuring default playbook repos

Failed to bootstrap playbook repos
Install failed."

Detailed error logs look kind of ugly, but seeing this:

File \"/opt/splunk-soar/usr/python39/lib/python3.9/site-packages/git/cmd.py\", line 1388, in execute", " raise GitCommandError(redacted_command, status, stderr_value, stdout_value)", "git.exc.GitCommandError: Cmd('git') failed due to: exit code(128)", " cmdline: git ls-remote --heads https://github.com/phantomcyber/playbooks", " stderr: 'fatal: unable to access 'https://github.com/phantomcyber/playbooks/': SSL certificate problem: self-signed certificate in certificate chain'"], "time_elapsed_since_start": 6.000021, "time_elapsed_since_operation_start": 4.386305}

Re: Error while installing SOAR version 6.4.1

PrewinThomas — Fri, 07 Nov 2025 04:13:33 GMT

@SOAR_098

The error SSL certificate problem: self-signed certificate in certificate chain means the system’s CA trust store is incomplete. You need to fix certificate trust so the installer can clone the default playbook repo.

Run manually as the phantom user, you will be getting same error message.

git ls-remote https://github.com/phantomcyber/playbooks

Refer below,

#https://community.splunk.com/t5/Splunk-SOAR/quot-Failed-to-bootstrap-playbook-repos-quot-on-clean-install/m-p/709534

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Error while installing SOAR version 6.4.1

thahir — Fri, 07 Nov 2025 06:13:33 GMT

@SOAR_098 The error which you encountered is because of ssl cert , the ssl cert is not trusted by the server.

Import the necessary cert to the host, you can refer the below url for more reference.

https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-splunk-soar-on-premises-certificate-store/add-remove-or-replace-certificates-from-the-splunk-soar-on-premises-certificate-store

Re: Error while installing SOAR version 6.4.1

livehybrid — Fri, 07 Nov 2025 06:47:45 GMT

Hi @SOAR_098

Is your instance behind a proxy server? Could you try the following to show what certificate is returned:

openssl s_client -showcerts -connect github.com:443

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Error while installing SOAR version 6.4.1

PickleRick — Fri, 07 Nov 2025 07:24:15 GMT

The typical reason for this if you're doing it in corporate environment is TLS inspection sollution. It does a MITM on the connection and uses its own CA to dynamically create a cert for your connection. This CA's cert is typically pushed to endpoints with GPO, Ansible or whatever your company is using.

Re: Error while installing SOAR version 6.4.1

SOAR_098 — Fri, 07 Nov 2025 17:56:20 GMT

For this would need the certificate to add but this $SOAR_HOME/etc/cacerts.pem is created after SOAR is installed. So even if I add that missing certificate, during fresh reinstallation, how to add that certificate then?

Re: Error while installing SOAR version 6.4.1

SOAR_098 — Fri, 07 Nov 2025 17:59:24 GMT

Executing the below command, it does not give error

git ls-remote https://github.com/phantomcyber/playbooks

Re: Error while installing SOAR version 6.4.1

SOAR_098 — Fri, 07 Nov 2025 18:00:40 GMT

I do see some certificates on executing these commands, do I need to add those somewhere before starting installation of SOAR?

Re: Error while installing SOAR version 6.4.1

SOAR_098 — Fri, 07 Nov 2025 18:02:28 GMT

What would be the additional certificates in that case if I can add to avoid the issue? And where usually we can add those before starting installation?