@David_Loureiro The “Find More Apps” browser in Splunk Enterprise 10.0.2 uses Splunk’s built‑in trust store ($SPLUNK_HOME/etc/auth/cacert.pem) for outbound HTTPS calls to Splunkbase, not your custom bundle. When you replaced or redirected the trust store to include only your internal CA, you inadvertently broke validation against public roots like DigiCert, which Splunkbase relies on. The supported approach is to append your internal CA to the default Splunk CA bundle rather than override it, ensuring outbound public CA validation continues to work. In this situation, to fix it. You can try the below: Do not replace the default cacert.pem file. Append your internal CA certificate to Splunk’s existing bundle cat my_internal_ca.pem >> $SPLUNK_HOME/etc/auth/cacert.pem Keep caTrustStore = splunk,os so Splunk trusts both its own bundle and the OS trust store Restart Splunk after updating the bundle This ensures public roots (DigiCert, etc.) remain trusted while also allowing mTLS with your internal CA. Hope it helps. >> If this post addressed your question, you can: Give it karma to show appreciation 👍 Mark it as the solution if it solved your issue ✔️ Add a comment if you’d like more details ✏️ Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise. >>
... View more