Unable To Upgrade Agent: “Server Validation Failed, Mismatched Public Key Supplied”

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Error when attempting to upgrade Agent via Console:

Agent upgrade: Failed to download upgrade package: https://ServerAddress/hostpkg/pkg.php?pkg=/ParityHostAgent.msi. WinHttpReceiveResponse: Server validation failed, mismatched public key supplied.
This error happened 2 time(s)"

Environment

• App Control Server: 8.8.2 and Higher
• App Control Agent: 8.7.2 and Higher
• Microsoft Windows: All Supported Versions

Cause

The certificate bound to the Resource Download Location (RDL) is not currently Trusted in the Trusted Communication Certificate list.

Resolution

1. Verify the Resource Download Location (RDL) is accurate and contains the necessary files.
2. Verify the certificate used for the RDL matches a certificate listed as Trusted in the Console > System Configuration > Security > Trusted Communication Certificates.
   • If necessary, the current Agent Communication Certificate can be exported and used in IIS. Export the existing Agent Communication Certificate.
   • If necessary, a new certificate can be imported to the Trusted Communication Certificates list.
   • If the Trusted Communication Certificates list is missing, enable it.
3. If the certificate is already in the list:
   • Verify Agent(s) are Connected, Up to Date, and no Upgrade Pending.
   • Verify the Trust for the relevant certificate is enabled.
   • Rebuild the TrustedCertList.pem file.

Additional Information

• If SSL Inspection, or some other network filtering/monitoring, is happening on Port 443 between the endpoint and the file download, this could cause difficulty in acquiring the file.
• If the issue persists, please open a case with Support and provide the Agent Historical Logs as well as a screenshot of the full page from the Console > System Configuration > Security