SSL Certificate Verification Failed Error in Splunk Security Essentials App with Self-Signed Certificates

Applicability

- Splunk Enterprise all versions - Environments using self-signed certificates or certificates in custom certificate chains

Description

When attempting to access specific features in the Splunk Security Essentials app, such as  Framework dashboards or the Data Inventory page, users may encounter SSL certificate verification failures. The app is unable to connect to external resources it needs to display these dashboards correctly. 

The error message appears as:

urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1143)>

Or in some versions:

urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1106)>

This issue occurs because the SSE app uses Python's urllib library to make HTTPS connections to external resources (such as GitHub APIs for data), but Python's SSL certificate verification is failing to validate the certificate chain. This can happen even when the certificates are properly configured at the system level and curl commands work successfully.

Investigation

To determine if you are experiencing this issue, follow these steps:

 

1. Navigate to the Splunk Security Essentials app and try to access either the  Framework dashboard under Analytics Advisor or the Data Inventory page.

 

2. If you see an error message similar to the one below, you are experiencing this issue:

Traceback (most recent call last):File "/opt/splunk/lib/python3.9/urllib/request.py", line 1346, in do_openh.request(req.get_method(), req.selector, req.data, headers,File "/opt/splunk/lib/python3.9/http/client.py", line 1285, in requestself._send_request(method, url, body, headers, encode_chunked)File "/opt/splunk/lib/python3.9/http/client.py", line 1331, in _send_requestself.endheaders(body, encode_chunked=encode_chunked)File "/opt/splunk/lib/python3.9/http/client.py", line 1280, in endheadersself._send_output(message_body, encode_chunked=encode_chunked)File "/opt/splunk/lib/python3.9/http/client.py", line 1040, in _send_outputself.send(msg)File "/opt/splunk/lib/python3.9/http/client.py", line 980, in sendself.connect()File "/opt/splunk/lib/python3.9/http/client.py", line 1454, in connectself.sock = self._context.wrap_socket(self.sock,File "/opt/splunk/lib/python3.9/ssl.py", line 506, in wrap_socketreturn self.sslsocket_class._create(File "/opt/splunk/lib/python3.9/ssl.py", line 1049, in _createself.do_handshake()File "/opt/splunk/lib/python3.9/ssl.py", line 1318, in do_handshakeself._sslobj.do_handshake()ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1143)

 

3. Verify that your system certificates appear to be functioning correctly by running:

$SPLUNK_HOME/bin/splunk cmd curl -v https://api.***.com/latest

If curl succeeds but the app still shows certificate errors, this confirms you're experiencing this issue.

 

4. Check what certificate paths Python is using in your environment:

$SPLUNK_HOME/bin/splunk cmd python -c "import ssl; print(ssl.get_default_verify_paths())"

Notice if the paths shown include the locations where your certificates are stored.

Resolution

To resolve this SSL certificate verification issue in the Splunk Security Essentials app, you can use one of these approaches:

 

Option 1: Add certificates to Splunk's Python certificate bundle

 

1. Identify which certificate paths Python is using:

$SPLUNK_HOME/bin/splunk cmd python -c "import ssl; print(ssl.get_default_verify_paths())"

 

2. Append your CA certificates to all the following paths:

$SPLUNK_HOME/lib/python3.7/site-packages/certifi/cacert.pem

$SPLUNK_HOME/lib/python3.9/site-packages/certifi/cacert.pem

$SPLUNK_HOME/etc/auth/cacert.pem

 

3. Restart Splunk:

$SPLUNK_HOME/bin/splunk restart

 

Option 2: Configure Python's certificate verification environment variables

 

1. Edit your systemd service file (if using systemd) at `/etc/systemd/system/Splunkd.service` and add these lines in the `[Service]` section:

Environment=REQUESTS_CA_BUNDLE=/opt/splunk/openssl/cert.pem

Environment=SSL_CERT_FILE=/opt/splunk/openssl/cert.pem

 

2. Copy the system certificate to Splunk's expected location:

Create the directory if it doesn't exist

mkdir -p /opt/splunk/openssl/

 

Copy the system certificate to Splunk's expected location

cp /etc/pki/tls/cert.pem /opt/splunk/openssl/cert.pem

 

3. Reload the systemd configuration:

systemctl daemon-reload

 

4. Configure the Search Head hostname in web.conf:

   

Add the following entry to `$SPLUNK_HOME/etc/system/local/web.conf`:

[settings]mgmtHostPort = <your-splunk-search-head-fqdn>:8089

 

5. Restart Splunk:

$SPLUNK_HOME/bin/splunk restart

 

Option 3: Temporary workaround 

As a temporary workaround, you can modify the SSE app's Python scripts to bypass SSL verification:

 

1. Add the following code to the beginning of the affected Python scripts in the SSE app [.py scripts]:

import sslssl._create_default_https_context = ssl._create_unverified_context

 

2. This bypass should only be used in intranet-only deployments and with approval from your security team, as it disables SSL certificate validation entirely.

Related Links

[Splunk Documentation: Web.conf]

[Python SSL Module Documentation]

[PEP 476: Enabling Certificate Verification by Default]

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release