App Control: "Failed Signature Verification" Error When Installing Packages on Server

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Adding Rules and/or Agent Installers to the Console causes an error.
• Events in the Console with the Subtype, "Install Failed":

C:\Program Files (x86)\Bit9\Parity Server\HPIFiles\RulesInstaller.exe failed signature verification 
C:\Program Files (x86)\Bit9\Parity Server\HPIFiles\WindowsHostPackageInstaller.exe failed signature verification

 

Environment

• App Control Server: Version 8.1.4 - 8.8.2
• Rules Installer: All Supported Versions
• Agent Host Package Installer: All Supported Versions

Cause

The App Control Server is unable to go out to the Internet to check the Certificate Revocation List.

Resolution

• Upgrade to App Control Server version 8.8.4 or higher.
• If the application server is in an air gapped or limited network environment, the installer will need to be executed directly on the application server.

Additional Information

The hostPackageInstallerSignatureCheck shepherd config has been removed and there is no longer a way to disable the certificate validation check.