CB Response: How to find the CB Response sensor certificate information

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to find the CB Response sensor certificate. 

Environment

• CB Response Server: All Versions
• CB Response Sensor: All Versions

Resolution

From the CB Response Sensor

1. Run regedit
2. Navigate to the keys:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\carbonblackk\

3. Find the Certificate info listed as:

   SensorClientCert

4. Find the Key info listed as:

   SensorClientKey

From the CB Response Server

1. Open in an editor:

   /etc/cb/cb.conf

2. Find the locations listed with the values:

   SSLCertFile 
   and 
   SSLKeyFile