App Webtool - SLL error, certificate verify failed

[M4rv1m]

Hello @jkat54!

I'm having some trouble getting the app to work, and the ultimate goal is to be able to change the ownership of searches automatically (e.g. from a scheduled report).
Here is the search:

``` get all info about the searches on the instance ```
| rest /services/saved/searches splunk_server=local

``` exclude every search where are from user “user” , are disabled and they come only from app search ```
| search eai:acl.owner!="user2 " disabled = 0 eai:acl.app = "search"
| rename eai:acl.owner as owner, eai:acl.app as app, eai:acl.sharing AS sharing

```extract the management port and the search name already urlencoded ```
| rex field=id "^\S+(?<mngmport>\:\d+)\/servicesNS\/\S+\/saved\/searches\/(?<search_name>\S+)$"

``` buid the uri for the curl  mngmport =: mngmport ```
| eval url = https:// + splunk_server + mngmport +"/servicesNS/"+ owner +"/"+ app +"/saved/searches/"+ search_name +"/acl"

``` future use, not yet implemented ```
| eval description = description + " - moved from " + owner

``` constructing data= {"owner":"user2","sharing":"global"} ```
| eval data = json_object("owner", "user2", "sharing", sharing)

``` debug & Co ```
| table splunk_server app owner title description disabled action.notable cron_schedule url data id sharing *

``` the curl, which isn't working/ i'm probably doing something wrong here ```
| curl urifield=url method="post" splunkauth="true" debug=true datafield=data
| table curl*

I've tried to specify the cert in some way, but it seems that there are no args that I can pass for it.
Since I can't find a solution to this (searching online I found a suggestion to bypass ssl inspection, but in my case I don't think I can solve it with that), I'm here to ask for help.

I prefer to avoid using simple authentication (user:password).

The error I get is from the curl_message field:

HTTPSConnectionPool(host='host', port=8089): Max retries exceeded with url: /servicesNS/user1/search/saved/searches/dummy%20search/acl (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1143)')))

curl_status: 408

Thanks in advance!

[livehybrid]

Hi @M4rv1m 

Are you running on-prem or Splunk Cloud? This app actually uses Python requests under the hood with verify=True set - this means it is expecting a valid certificate based on the CAs it has access to.

I believe you can overwrite the request CAs using an environment variable "REQUESTS_CA_BUNDLE" - this means you could possible set this in $SPLUNK_HOME/etc/splunk-launch.conf to the CA of your Splunk instance, eg:

REQUESTS_CA_BUNDLE=/opt/splunk/etc/auth/cacert.pem

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[M4rv1m]

Hi @livehybrid

Thank you for your answer, but it didn't solve my problem unfortunately.

I'm currently on a On-prem enviroment, and the workaround that i found was to put the verify parameter (this one directly in the curl.py) to false.

line 99
r = requests.post(uri,data=payload,verify=False,cert=cert,headers=headers,timeout=timeout)

Maybe not the best, but it's working.

[splunkreal]

Thanks @M4rv1m it works. I hope @jkat54  will add an option for that 🙂

[jkat54]

That functionality already exists in version 2.x which should still be available on splunkbase and is certainly available on my github that's linked to "source code" in splunkbase.

it was removed in 3.x for cloud compatibility.

Please take secure communications seriously and consider implementing tls1.2+

Thanks!