After upgrade to Splunk 9.0, ServiceNow Security Operations Addon is no longer working

[rcarmack1]

We upgraded to Splunk 9.0 and the ServiceNow Security Operations Addon is no longer working. The app is at the latest version in Splunkbase. Below is a copy of one of the error logs. I have manually checked the rest url, account, and the proxy being used.  To be clear, this is an issue we are experiencing is in the ServiceNow-built integration that is available in Splunkbase.

Unable to connect to ServiceNow. Error: Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 696, in urlopen
self._prepare_proxy(conn)
File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 964, in _prepare_proxy
conn.connect()
File "/opt/splunk/lib/python3.7/site-packages/urllib3/connection.py", line 359, in connect
conn = self._connect_tls_proxy(hostname, conn)
File "/opt/splunk/lib/python3.7/site-packages/urllib3/connection.py", line 506, in _connect_tls_proxy
ssl_context=ssl_context,
File "/opt/splunk/lib/python3.7/site-packages/urllib3/util/ssl_.py", line 450, in ssl_wrap_socket
sock, context, tls_in_tls, server_hostname=server_hostname
File "/opt/splunk/lib/python3.7/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
File "/opt/splunk/lib/python3.7/ssl.py", line 428, in wrap_socket
session=session
File "/opt/splunk/lib/python3.7/ssl.py", line 878, in _create
self.do_handshake()
File "/opt/splunk/lib/python3.7/ssl.py", line 1147, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1106)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/requests/adapters.py", line 449, in send
timeout=timeout
File "/opt/splunk/lib/python3.7/site-packages/urllib3/connectionpool.py", line 756, in urlopen
method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
File "/opt/splunk/lib/python3.7/site-packages/urllib3/util/retry.py", line 574, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='[redacted]', port=443): Max retries exceeded with url: /api/now/table/em_event (Caused by SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1106)')))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ServiceNow-SecOps/bin/sn_connect.py", line 40, in postData
return requests.post(url, auth=(user, pwd), proxies=proxies, headers=headers, data=dataValues)
File "/opt/splunk/lib/python3.7/site-packages/requests/api.py", line 119, in post
return request('post', url, data=data, json=json, **kwargs)
File "/opt/splunk/lib/python3.7/site-packages/requests/api.py", line 61, in request
return session.request(method=method, url=url, **kwargs)
File "/opt/splunk/lib/python3.7/site-packages/requests/sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "/opt/splunk/lib/python3.7/site-packages/requests/sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "/opt/splunk/lib/python3.7/site-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='[redacted]', port=443): Max retries exceeded with url: /api/now/table/em_event (Caused by SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1106)')))

https://splunkbase.splunk.com/app/3921/

[rcarmack1 · Accepted solution]

Turns out it was a change between http/https, as forced by the newer version of Splunk 9.0.

[craigl1]

We have just upgraded to v9.0.2 also and have the exact same problem. What exactly did you do to resolve this?

I've seen the fix for the ServiceNow App (disable_ssl_certificate_validation) but we are running a custom python script called via an Alert Action in Splunk.