App Control: Why Is the Server Generating Alerts for Revoked Certificates?
search cancel

App Control: Why Is the Server Generating Alerts for Revoked Certificates?

book

Article ID: 286562

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Why is the Server generating Revoked Certificate Alerts similar to:
Server detected revocation of certificate 'ABC123'. Error: 04000025:CERT_TRUST_IS_NOT_TIME_VALID:CERT_TRUST_IS_REVOKED:CERT_TRUST_IS_UNTRUSTED_ROOT:CERT_TRUST_IS_EXPLICIT_DISTRUST

Environment

  • App Control Console: All Supported Versions

Resolution

The Built-in Revoked Certificate Alert (Tools > Alerts > Revoked Certificate Alert) has been Enabled. This Alert is designed to trigger when a Certificate Authority has revoked a Certificate that matches one in the environment.

Additional Information

  • Typically a certificate would be revoked due to encryption keys being compromised, inaccurate information in the certificate, or if the Certificate Owner is no longer deemed as trusted.
  • In some instances customers configure this Alert so that they can take further action. This may include removing a Certificate Approval, or verifying no new files signed with the Revoked Certificate exist in the environment 
  • The Alert can be configured to trigger only for specific Publishers, "Example: Apple, Inc".