I had the same issues at first and have concluded that something changed with the python libraries between 8.x and 9.x. I have not done an intense review.. YET. But This is what I found. CA certs in the following locations are ignored. 3rdparty/certifi/cacert.pem lib/certifi/cacert.pem The first just never gets accessed anywhere in the code. [splunk_ta_o365]$ find . -name \*.py | xargs -ifname grep -iH 3rdparty fname ./bin/splunk_ta_o365_rest_handlers.py:# Adding 3rdparty folder in sys.path for using future module And the second does not even get checked. Since the certifi lib is not getting included. I created this test to see. By using one of the existing o365 mod inputs. from splunk_ta_o365_bootstrap import setup_python_path, run_module
import sys
if __name__ == "__main__":
try:
setup_python_path()
import certifi
import requests
print('PATH = ' + ":".join(sys.path))
print('CAcert = '+ certifi.where())
print('Checking connection to MS...')
test = requests.get('https://login.microsoftonline.com')
print('Connection to MS.')
except requests.exceptions.SSLError as err:
print('SSL Error. ' + err) Run it as below. If it fails, it means that you do not have the needed certs. [splunk_ta_o365]$ splunk cmd python3 bin/testssl.py PATH = /opt/splunk/etc/apps/splunk_ta_o365/bin:/opt/splunk/etc/apps/splunk_ta_o365/lib:/opt/splunk/etc/apps/splunk_ta_o365/bin:/opt/splunk/etc/apps/splunk_ta_o365/bin:/opt/splunk/lib/python37.zip:/opt/splunk/lib/python3.7:/opt/splunk/lib/python3.7/lib-dynload:/opt/splunk/lib/python3.7/site-packages:/opt/splunk/lib/python3.7/site-packages/bottle-0.12.19-py3.7.egg CAcert = /opt/splunk/lib/python3.7/site-packages/certifi/cacert.pem Checking connection to MS... Connection to MS. It is the system CA cert file that is getting read. If you add your proxy certs, etc to the bottom of it. It should work. I have not looked for the exact reason as of yet, nor filed a ticket yet. This was just a work around and NOT the way to do this. I hope it helps. Cheers.
... View more
