Office365 - Azure Audit certificate failure (Red Hat with Proxy) issue

[abalogh_splunk]

Hi,
We are still getting errors even though we have added our Root CA and Intermediate CA to Red Hat's local certificate db.

We are using Splunk_TA_microsoft-cloudservices v2.03 on Splunk Enterprise 6.6.2 running on Red Hat 7.4

Root CA added to /etc/pki/ca-trust/source/anchors/company_root.pem (base64 encoded)
Intermediate CA added to /etc/pki/ca-trust/source/anchors/company_int.pem (base64 encoded)

update-ca-trust

AuthenticationError: , SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:676)

[season88481]

We have the similar issue too. So appending our own CA cert to the bottom of the cacert.pem fixed our issue.

Please note at our version (4.1.3) the cacert.pem is located at $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-cloudservices/lib/certifi/ folder. if you cannot find it at these folders, perhaps use any "find" command would do the trick.

I think Splunk should document this workaround at the doc, as it is very common that companies would use their own company signed certificate for the Azure management endpoint.

[abalogh_splunk · Accepted solution]

I will answer my own question because this was not documented. I had to read code.

The correct certificate file to update with your Root CA and intermediate CA (which we need since we are inspecting SSL traffic) was:

Splunk_TA_microsoft-cloudservices/bin/splunktamscs/certify/cacert.pem

We appended the /etc/pki/tls/certs/ca-bundle.crt to Splunk_TA_microsoft-cloudservices/bin/splunktamscs/certify/cacert.pem and started working.

[laurie_gellatly]

This fixed the problem that I was facing. Thanks for posting.