All Apps and Add-ons

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20 (solution)

lim2
Communicator

Splunk Connect for Zoom stopped working after Zoom enforced use of ssl certificates on 2022/07/20

After support tickets with Zoom and Splunk here are some experience would like to share.
Using signed ssl certificates private or internal CA did not work.
It seems that I had to use a certificate signed a commercial CA like Entrust.
If you want to chain your ssl certificate with Entrust root and intermediate certificates, please ensure that the certificates are in the order as follows after running the command:
openssl crl2pkcs7 -nocrl -certfile yoursslcertificate.entrust.pem | openssl pkcs7 -print_certs -noout
Or you could just include the commercially issued ssl certificate without the root and intermediate certificates.

 

 

 

subject=/C=US/ST=STATE/L=CITY/O=ORG, Inc./CN=mycompany.com
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K

subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

subject=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
issuer=/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2

 

 

 

If all works after restarting Splunk, running the netstat -nap |grep 9997 will show the following connections from Zoom ip addresses and you would see logs under the sourcetype=zoom:webhook

 

 

 

tcp        0      0 0.0.0.0:4443            0.0.0.0:*               LISTEN      25849/python3.7
tcp        0      0 10.#.#.#:4443      3.235.82.171:41101      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:58497      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:54514      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:48513      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:53006      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:55259      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:46028      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:52837      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.172:7527       TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.82.171:12934      TIME_WAIT   -
tcp        0      0 10.#.#.#:4443      3.235.83.101:32088      TIME_WAIT   -

 

 

 

 

 

Labels (2)
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...