Why did SA-ldapsearch stop working after upgrade to Splunk 9?

[gazoscreek]

We recently upgraded to Splunk 9.0.0 on our platform and the Splunk Add-On for Active Directory stopped working. We connect to our Active Directory instance using SSL ... and we're getting errors like this one now

2022-10-20 08:05:03,580, Level=ERROR, Pid=5668, File=search_command.py, Line=390, Abnormal exit: (LDAPSocketOpenError('socket ssl wrapping error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1106)'),)

What needs to be changed in order to make this work with Splunk 9?

... (We still have an instance running 8.2.6 and the AddOn still works perfectly fine there with the exact same configuration)

( we're using the most recent version {3.0.5} of SA-ldapsearch )

Thank you

[dimasfs]

My workaround was to specify (also on ssl.conf) the

[sslConfig]
caCertFile = <my_ca_file_relative_to_sslRootCAPath>

BUT, as we can read at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf

caCertFile = <filename>
* DEPRECATED. Use the 'sslRootCAPath' setting instead.
* Used only if 'sslRootCAPath' is not set.
* File name (relative to 'caPath') of the CA (Certificate Authority)
  certificate PEM format file containing one or more certificates
  concatenated together.
* Default: cacert.pem

So I guess this is a matter of upgrading the app. I will file a case on it. The app was supposed to work without this deprecated setting.

[gazoscreek · Accepted solution]

We were able to resolve this by deploying an ssl.conf in the app with the following flag disabled:

sslVerifyServerCert = false