Sensor Not Checking in - Error 0x80092013 - Unable to Check Revocation

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Endpoint Standard sensor fails to install
• Endpoint Standard sensor stops checking in to the console
• The following error can be observed in the confer logs 

  http: schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

The sensor asked the OS to validate the certificate with a CRL check and it was unsuccessful.

Resolution

Option 1:

Configure the proxy or firewall to allow CRL traffic as documented in the Firewall Configuration Guide

• http://crl.godaddy.com
• http://crl3.digicert.com
• http://crl4.digicert.com
• http://ocsp.godaddy.com
• http://ocsp.digicert.com

Option 2:

Configure the CRL checks used by the sensor

Additional Information

• Additional information can be found about What are some concerns with disabling the CRL check within the Sensor?
• CAPI2 logging can be enabled on the affected device to provide further insight into CRL traffic