App Control: Approvals Out of Date on Agents & High CPU on App Control Server

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• High CPU on App Control Server Services
• High CPU on PHP-cgi.exe process
• Approval out of date in most of the computers
• IIS logs reporting thousands of events similar to: 

  2022-01-01 00:00:00 00.00.00.00 GET /hostpkg/pkg.php pkg=TrustedCertList.pem 443 - 00.00.00.00 Bit9+Parity - 000 0 0 00

Environment

• App Control Server: 8.7.X and Higher
• App Control Agent: 8.7.X and Higher

Cause

TrustedCertList.pem file is corrupted

Resolution

1. Verify the Resource Download Location (RDL) specified is correct.
2. Log in to the application server as the Carbon Black Service Account.
3. If an Agent is installed, temporarily disable Tamper Protection.
4. Stop the App Control Server service.
5. Delete the file:

   C:\Program Files (x86)\Bit9\Parity Server\hostpkg\TrustedCertList.pem
   

6. Start the App Control Server service, and verify the file is rebuilt.
7. If an alternate Resource Download Location is being used, verify the new file is synced to the alternate RDL correctly.