How to solve security issue when using Rest API to connect to splunk?

[shai]

I develop an app on a private Splunk Enterprise server and have a piece of code that accesses the rest api:

# Use Splunk REST API to get all input parameters
splunkd_uri = os.environ.get("SPLUNKD_URI", "https://127.0.0.1:8089")

endpoint = f"{splunkd_uri}/servicesNS/nobody/{app_name}/data/inputs/{app_name}"

headers = {
'Authorization': f'Splunk {session_key}'
}

response = requests.get(endpoint, headers=headers, verify=False, timeout=30)

Everything works locally but when I run app-inspect before submitting to splunkcloud I get:

FAILURE: If you are using requests.get to talk to your own infra
with non-public PKI, make sure you bundle your own CA certs as part
of your app and pass the path into requests.get as an arg. File:
bin\utils\splunk_rest.py Line Number: 19

I am trying to understand how to solve this issue, because if I put a CA that matches the server I am working on, it will not satisfy the splunkcloud server that my clients will use.

I think I am misunderstanding a core piece around how to utilize Rest API pragmatically.

What is the correct way to go about this?
Can it work both for Splunk enterprise and on Splunk Cloud?

any clue or tip may help
Thanks

[tej57]

Hello @shai,

In this scenario, you'll need to combine your certs along with SplunkCloud certificates. Just append the CA file to include self signed certificate and SplunkCloud rootCA and use the same for communication. This chain will help you communicate with both Splunk Enterprise On-Prem and SplunkCloud environment.

Thanks,
Tejas.

---

The above solution helps, an upvote is appreciated.!! 

[shai]

Thank you for the kind reply!
Where can I find SplunkCloud rootCA ?

[tej57]

Hello @shai,

You can find the SplunkCloud root CA from the Universal Forwarder package present on your SplunkCloud search head. It gives you a forwarder package with preconfigured outputs to forward the data to SplunkCloud indexers. Within the same app, you can find the certificates that you need to append your self signed ones with. The package name should go something like this - 100_<<stack_name>>_splunkcloud

Thanks,
Tejas.