Hi Splunkers!
We have installed the SailPoint Adaptive Response app on a heavy forwarder but when setting up the inputs we are faced with a certificate verify error.
2020-09-18 10:01:47,091 ERROR pid=31820 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/ta_sailpoint_identitynow_auditevent_add_on/modinput_wrapper/base_modinput.py", line 127, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/sailpoint_identitynow_auditevent.py", line 72, in collect_events
input_module.collect_events(self, ew)
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/input_module_sailpoint_identitynow_auditevent.py", line 225, in collect_events
token_response = helper.send_http_request(token_url, "POST", parameters=tokenparams, payload=None, headers=None, cookies=None, verify=True, cert=None, timeout=None, use_proxy=use_proxy)
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/ta_sailpoint_identitynow_auditevent_add_on/modinput_wrapper/base_modinput.py", line 476, in send_http_request
proxy_uri=self._get_proxy_uri() if use_proxy else None)
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/ta_sailpoint_identitynow_auditevent_add_on/splunk_aoblib/rest_helper.py", line 43, in send_http_request
return self.http_session.request(method, url, **requests_args)
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/ta_sailpoint_identitynow_auditevent_add_on/requests/sessions.py", line 488, in request
resp = self.send(prep, **send_kwargs)
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/ta_sailpoint_identitynow_auditevent_add_on/requests/sessions.py", line 609, in send
r = adapter.send(request, **kwargs)
File "/opt/splunk/etc/apps/TA-sailpoint-identitynow-auditevent-add-on/bin/ta_sailpoint_identitynow_auditevent_add_on/requests/adapters.py", line 497, in send
raise SSLError(e, request=request)
SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:742)
Does anyone know where or how to specify certificate location or keystores in the SailPoint Adaptive Response app? I believe the reason why the verification is failing is because the cert being used is from internal root CA. We have installed the root cert in the OS keystore but still no luck. Any assistance would be appreciated!
