Check Point OSPEC LEA app 2.0.2 Error: The referred entity does not exist in the Certificate Authority

[jbsplunk]

I recently installed the Splunk Add-on for Check Point OSPEC LEA application (2.0.2), and when I attempt to Add a New Connection I get this UI error when Pulling the Certificate

Manage Connections: New Connection > Pull Certificate > SIC Details

/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/pull-cert.sh: ../opsec-tools/opsec_pull_cert: rc=-1 err=-93 The referred entity does not exist in the Certificate Authority

Has anyone run into this? How can I solve the problem?

[Chubbybunny · Accepted solution]

This typically occurs when either of these conditions have been met:

Splunk details > OPSEC App Name is referring to an object that has Not been defined in the Policy Editor

Splunk details > OPSEC App Name is referring to an object that has already had the certificate pulled over. Verify the Policy editor >> Splunk application has a trust state as 'Initialized', if so, reset the password and 'install the database' again to pull the cert once more

Splunk details > OPSEC App Name is referring to an object that has not yet had a SIC certificate created for it. For example, the 'communication' button has Not been pressed and a SIC certificate has not been created for it

else open a Support case.

(\__/)
(='.'=)
(")_(")

[georgen_splunk]

This can also occur when the OPSEC App Name contains a combination of non-alphabetic and numeric characters. i.e SplunkLEA-US