Had the exact same issue, and this solution worked for me as well.
THANK YOU, THANK YOU, THANK YOU!!!
Too many certs in too many places if you ask me.
I searched all over the web and mostly got Python related suggestions.
I also searched all over Splunk directories and found about 20 different locations of where certs are stored, so it's hard to know which are in use and when.
Added our intermediate and root certs to the file mentioned in the solution, one I had not tried yet, and voila!
Embarrassingly, I have spent days on this issue, so thanks again!
Pasting the file location again, since it was the magic touch:
/opt/splunk/etc/apps/Splunk_TA_aws/bin/3rdparty/botocore/vendored/requests/cacert.pem
... View more