SSL Verification Error (can't add custom ca)

[CH3ST3R0]

Hello,

I am trying to set up your add-on to get feed from our OpenCTI instance, however I have issue connecting to it. Since your script enforces ssl (no complains here) I am constantly getting errors:

Max retries exceeded with url: /stream/3cebde52840a?recover=2025-08-27T15:33:31Z (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1161)')))

So I wanted to explicitly tell it where to find my custom ca, but it is not possible (it looks requests are using, sort of default value, which is quite problematic in openshift container). Do you know any possible workaround, or do you plan to add this feature in next version release?

[5tevebaker]

I don't know how you'd implement this in a container, but this is what I did to trust my OpenCTI self-signed certificate from the add-on.

# Find where Python's certs are
CERT_PATH=$(/opt/splunk/bin/splunk cmd python3 -c "import certifi; print(certifi.where())")

# Get OpenCTI cert chain
openssl s_client -connect your-opencti-domain:443 -showcerts </dev/null 2>/dev/null | \
  sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' > /tmp/opencti-fullchain.pem

# Backup and append
cp $CERT_PATH ${CERT_PATH}.backup
cat /tmp/opencti-fullchain.pem >> $CERT_PATH

# Restart Splunk
/opt/splunk/bin/splunk restart