Log Observer Connect - Status 400 Cert error.

Applicability

Log Observer Connect Splunk Cloud.

Description

For a previously working implementation, any attempt to reach Splunk Cloud Enterprise from Log Observer Connect returns following message:

 {"HTTPStatusCode":400,"HTTPStatus":"None provided","Message":"SplunkLogs HTTP Error Invalid or incorrect splunk enterprise cloud certificateOperation failed because of invalid/incorrect certificate for orgID: XXXXX connection: XXXXXX"}

No connection between Log Observer and Splunk.

Investigation

This sort of behavior is likely related to a standard Splunk>Cloud certificate rotation.
Log Observer would require a fresh certificate to fix the SSL related errors and restore connection.

Resolution

There are three ways of fetching the Splunk>Cloud 8089 certificate chain for Log Observer Connect.

1. Self-Service via a script:
   • In Observability Cloud go to "Settings > Log Observer Connect". 
   • Select "Download this script" in the guided setup section, "Secure connection to the Splunk platform", and follow the instructions on screen.
   • Make sure all script dependencies are met.
2. Manually using openssl:
   • Run the following command from a host allowed to make Rest API calls to the Splunk>Cloud Search Head via 8089:
     • openssl s_client -showcerts -servername "<stack-prefix>.splunkcloud.com" -connect "<stack-prefix>.splunkcloud.com:8089" < /dev/null
3. Support engagement:
   • Open a support ticket, with the Splunk Cloud team, for support to fetch the certificates on your behalf.

Keep in mind, Log Observer needs only the first certificate in the chain, including the BEGIN CERTIFICATE and END CERTIFICATE delimiters.

Paste the fetched certificates for the Log Observer Connect connection.

Related Links

Set up log observer connect

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release