The permission of cacert.pem looks root:root. Will that work ? Also the path /app/analytics/splunk/lib/python3.7/site-packages/certifi/cacert.pem has a certificate which seems interesting to me. Forescout document mentioned a different path.
... View more