All Apps and Add-ons

Splunk Add-on for Okta: Why does Splunk not accept SSL certificate?

bob_blood
Engager

Splunk Add-on for Okta API fails from SSL error. Probably due to a proxy changing the certs on the way back in. Splunk does not trust this different cert. I've seen similar problems floating around the web regarding proxies and certs with Splunk. Does anyone have a solution for this?

from internal logs: SSLHandshakeError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

Adding API target IP to the proxy bypass works but I'm trying to figure out a more robust solution.

PickleRick
SplunkTrust
SplunkTrust

If you're using a proxy solution which replaces the certificate on the connection (I assume your proxy does some content inspection), you need to add the cert of the CA the proxy uses to generate the certs on the fly to the trusted cert store. That's how TLS works.

0 Karma

MostafaKhalil
New Member

Hi @krishnacasso@bob_blood   and @ehaddad_splunk  . Were you guys able to fix this issue? I'm having the same failure in establishing the SSL handshake. I was hoping you can guide me with what you did to fix the issue on your ends.

 

Thank you,

0 Karma

krishnacasso
Path Finder

Hi Bob,
Is this issue resolved. We are getting same SSL handshake error. How did you by pass it with proxy, We are trying with below proxy settings. Do we need to give IP in proxy_url place.

[okta_proxy]
proxy_enabled = 1
proxy_type =
proxy_rdns = 1
proxy_url =
proxy_port =
proxy_username =
proxy_password =

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

what kind of SSL authentication your proxy requires? I think the problem is due to the fact the the proxy certificate are not trusted on the HWF machine where the add-on runs. I would start by adding the CA root to the trusted store on that machine.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...