New Certificates and New Publishers Not Being Processed Due to Certificate Loop

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• New Certificates are not found in the Console > Assets > Certificates, or there is a large delay in their appearance.
• New Publishers are not found in the Console > Rules > Software Rules > Publishers, or there is a large delay in their appearance.
• Last Validation Date for the Certificate is more than a week old

Environment

• App Control Server: All Supported Versions

Cause

• All certificates must be validated by the App Control Server before Publisher or Certificate details are displayed in the Console.
  • The Server queries the Windows CryptoAPI (CAPI) for the certificate details, including all Parent Certificates used to build the chain.
  • CAPI makes an OCSP call to the CRL Distribution Point included in the Certificate Details.
  • CAPI then returns the chain information about this certificate (including Publisher Name and all Parent Certificates).
• In very rare situations, Windows CryptoAPI will report a Parent Certificate that points to a Child Certificate as the parent, resulting in a Certificate Validation Loop.
  • When a loop occurs, the Server will stop validating certificates and this could result in a backlog of unprocessed Publisher and/or Certificate information

Resolution

• Changes in Server version 8.8.2 (EPCB-8346) added enhanced logic to reduce the potential of encountering this issue.
• The steps in Additional Information can be used to confirm whether this is happening in the environment.
• If there is evidence of a Certificate Validation Loop, open a case with Support and provide
  • Screenshots of the potential Certificate Validation Loop
  • Database Performance Logs

Additional Information

1. Run SQL Server Management Studio as the Carbon Black Service Account
2. Test Certificate Batch Validation is stuck
   1. Click New Query and execute the following:

      USE das;
      EXEC dbo.GetNextCertificateBatchToValidate;

      • Note the list returned and the first cert_id in the list (ex: cert_id 7472)
   2. Wait 5-7 minutes, click New Query and execute the same query again.
   3. Compare the first cert_id from each set of results. If they match, cert validation is likely stuck.
3. Build the Chain & Confirm whether a Certificate Validation Loop exists
   1. Using the relevant cert_id of the first stuck certificate (ex: 7472), execute the following query

      USE das;
      SELECT cert_id, parent_id, subject_name, last_validation_time FROM dbo.certificates (NOLOCK) 
      WHERE cert_id IN (7472)
      ORDER BY cert_id DESC;

   2. Add the resulting parent_id returned (ex: 8870) to the list, and execute again

      USE das;
      SELECT cert_id, parent_id, subject_name, last_validation_time FROM dbo.certificates (NOLOCK) 
      WHERE cert_id IN (7472, 8870)
      ORDER BY cert_id DESC;

   3. Repeat accordingly, adding each new parent_id to the list.
      • The chain should end with a cert_id having a parent_id of 0 (no parent).
      • If a Certificate Loop exists, two certificates will eventually reference each other, example: