Sensor not connecting via proxy/firewall

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Endpoint Standard sensor fails to install
• Endpoint Standard sensor stops checking in to the console
• The following error can be observed in the confer logs 

  http: schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline

• This issue may also occur in environments without a proxy
• This issue may occur on select machines while others with the same network configuration are able to communicate

Environment

• Carbon Black Cloud Windows Sensor: Version 3.3.x.x and Higher
• Microsoft Windows: All Supported Versions
• Network Proxy and/or Firewall

Cause

• CRL (Certificate Revocation List) checks are performed on a per application basis
• The 3.3.x.x and higher sensor relies on Windows to execute a CRL check
• The CRL traffic generated by Windows needs to be allowed
• This traffic is attempting to access the ocsp.godaddy.com and crl.godaddy.com domains

Resolution

#%$Depending on the environment, there are multiple options to allow this traffic not limited to but including the following general steps.  Specific steps will depend on environment configuration.#%$  

Options:

• Configure the Winhttp service on the affected machines to utilize the proxy for Windows CRL checks
• Configure the proxy or firewall to allow CRL traffic
• Allow port 80 traffic to crl.godaddy.com and ocsp.godaddy.com through the proxy or firewall
• For sensors 3.4.0.925 and higher review How To Configure Sensor Not To Require CRL Checks On Install  
• For sensors 3.8.0.722 and higher review How to Adjust CRL checking for Best Effort

Additional Information

• Additional information can be found about What are some concerns with disabling the CRL check within the Sensor?
• The minimum requirement to resolve this issue is to allow CRL check traffic to the crl.godaddy.com and ocsp.godaddy.com domains as noted in the last option listed under Resolution
• The crl.godaddy.com and ocsp.godaddy.com domains utilize OCSP (Online Certificate Status Protocol) and Certificate Revocation List (CRL) checks to validate the sensor's install certificate
• CAPI2 logging can be enabled on the affected device to provide further insight into CRL traffic
• If the issue is not resolved with the above configuration changes or only occurs on a subset of machines with the same network configuration, please open a support case