All Apps and Add-ons

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20 (solution)

lim2
Communicator

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20

After support tickets with Zoom and Splunk here are some experience would like to share.
Using signed ssl certificates private or internal CA did not work.
It seems that I had to use a certificate signed a commercial CA like Entrust.
If you want to chain your ssl certificate with Entrust root and intermediate certificates, please ensure that the certificates are in the order as follows after running the command:
openssl crl2pkcs7 -nocrl -certfile yoursslcertificate.entrust.pem | openssl pkcs7 -print_certs -noout
Or you could just include the commercially issued ssl certificate without the root and intermediate certificates.

 

 

 

subject=/C=US/ST=STATE/L=CITY/O=ORG, Inc./CN=mycompany.com
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K

subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

 

 

 

If all works after restarting Splunk, running the netstat -nap |grep 9997 will show the following connections from Zoom ip addresses and you would see logs under the sourcetype=zoom:webhook

 

 

 

tcp        0      0 0.0.0.0:4443            0.0.0.0:*               LISTEN      25849/python3.7
tcp        0      0 10.#.#.#:4443      3.235.82.171:41101      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:58497      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:54514      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:48513      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:53006      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:55259      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:46028      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:52837      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:7527       TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:12934      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.83.101:32088      TIME_WAIT   -

 

 

 

 

 

Labels (2)
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...