Troubleshooting Tip: Fix the SSL CERTIFICATE_VERIFY_FAILED error when configuring the Generic Log API Poller (HTTPS Advanced)

[vschmitt_FTNT]

Description	This article describes how to fix the SSL CERTIFICATE_VERIFY_FAILED error when configuring the Generic Log API Poller (HTTPS Advanced). The Generic Log API Poller (HTTPS_Advanced) Integration permits the FortiSIEM to poll any server using HTTPS API. The API uses HTTPS protocol and in case the server you are polling is using a non-default server certificate, the SSL connection will require the server's certificate to be trusted. If the server is not trusted, the Python script of the poller (genericHttpApiPoller.py) will output the following error: failed (Generic HTTP API Failed due to general error, failed to get events. Reason: HTTPSConnectionPool(host='example.host.name', port=443): Max retries exceeded with url: /connect/token (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)')))
Scope	FortiSIEM.
Solution	To be able to communicate with the third-party server, the FortiSIEM needs to know where to find the server's certificate. Locate the trusted certificate inventory file. Open a SSH session on the FortiSIEM. Launch Python interpreter: python >>> import certifi >>> certifi.where() '/usr/local/lib/python3.9/site-packages/certifi/cacert.pem' >>> quit() Append the server's CA certificate to that PEM file (more info at https://github.com/certifi/python-certifi). The second step will declare the cacert.pem in the genericHttpApiPoller.py : Make a backup version of the file /opt/phoenix/bin/genericHttpApiPoller.py. Modify the genericHttpApiPoller.py to locate the line regarding the ssl_cert_check and refer to the cacert.pem: If we need to verify ssl_cert_check: use the cacert.pem file https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification if self.ssl_cert_check: self.ssl_cert_check="/usr/local/lib/python3.9/site-packages/certifi/cacert.pem" As explained in the link https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification, the requests library either takes verify=False either takes a certfile. The script should now verify the server's certificate against the CA bundle and make the connection successful.