All Apps and Add-ons

Check Point OSPEC LEA app 2.0.2 Error: The referred entity does not exist in the Certificate Authority

jbsplunk
Splunk Employee
Splunk Employee

I recently installed the Splunk Add-on for Check Point OSPEC LEA application (2.0.2), and when I attempt to Add a New Connection I get this UI error when Pulling the Certificate

Manage Connections: New Connection > Pull Certificate > SIC Details

/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/pull-cert.sh: ../opsec-tools/opsec_pull_cert: rc=-1 err=-93 The referred entity does not exist in the Certificate Authority

Has anyone run into this? How can I solve the problem?

1 Solution

Chubbybunny
Splunk Employee
Splunk Employee

This typically occurs when either of these conditions have been met:

Splunk details > OPSEC App Name is referring to an object that has Not been defined in the Policy Editor

Splunk details > OPSEC App Name is referring to an object that has already had the certificate pulled over. Verify the Policy editor >> Splunk application has a trust state as 'Initialized', if so, reset the password and 'install the database' again to pull the cert once more

Splunk details > OPSEC App Name is referring to an object that has not yet had a SIC certificate created for it. For example, the 'communication' button has Not been pressed and a SIC certificate has not been created for it

else open a Support case.

(\__/)
(='.'=)
(")_(")

View solution in original post

Chubbybunny
Splunk Employee
Splunk Employee

This typically occurs when either of these conditions have been met:

Splunk details > OPSEC App Name is referring to an object that has Not been defined in the Policy Editor

Splunk details > OPSEC App Name is referring to an object that has already had the certificate pulled over. Verify the Policy editor >> Splunk application has a trust state as 'Initialized', if so, reset the password and 'install the database' again to pull the cert once more

Splunk details > OPSEC App Name is referring to an object that has not yet had a SIC certificate created for it. For example, the 'communication' button has Not been pressed and a SIC certificate has not been created for it

else open a Support case.

(\__/)
(='.'=)
(")_(")

georgen_splunk
Splunk Employee
Splunk Employee

This can also occur when the OPSEC App Name contains a combination of non-alphabetic and numeric characters. i.e SplunkLEA-US

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...