Cybervision Add On SSL Certificate

[lizo]

I am getting the error "SSL certificate verification failed. Please add a valid SSL Certificate or Change VERIFY_SSL flag to False" when attempting to add a new account in the configuration for the Cybervision add on. I am interested in setting the verify_ssl to false, but am having a difficult time finding the location to change this. Does anyone know the path/file that I can make this change on?

[dimmitrisd]

I don;t know how you can disable thism however if you want to use it, this procedure worked for me for using the CA certificate:

You check the check box “use Custom CA Certificate” and Grab the CyberVision’s Certificate Text via PowerShell, by opening your Administrator PowerShell window, and copy and paste this exact command block and press Enter: 

$webRequest = [System.Net.WebRequest]::Create("https://<your cybervision's url>")

try { $webRequest.GetResponse() } catch {}

$cert = $webRequest.ServicePoint.Certificate

[System.Convert]::ToBase64String($cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert), [System.Base64FormattingOptions]::InsertLineBreaks)

Then certificate will be spit out. ATTENTION 

You need afterwards to include the above generated certificate from the powershell into this below form , and add it in the text box of the spulnk’s configuration window like this:

-----BEGIN CERTIFICATE-----

PASTE_YOUR_POWERSHELL_TEXT_CERTIFICATE HERE

-----END CERTIFICATE-----

[PickleRick]

That's a quite old thread but since you responded, instead of fiddling with script contents you can try setting TLS parameters in  [pythonSslClientConfig] section of server.conf.

[db1]

I had the same error using a local instance of Cisco Cyber Vision and local Splunk Enterprise on Windows. 

I modified the file located at C:\Program Files\Splunk\etc\apps\TA-cisco_cybervision\bin\TA_cisco_cybervision_utils.py and changed VERIFY_SSL=True to VERIFY_SSL=False at the top of the document. The location of this file may be different depending on your installation.

I saved and restarted Splunk Enterprise (Settings>Server Controls>Restart Splunk)
Now when I try it again it works 🙂