Health Check FailureId[20]: Could Not Check Revocation or FailureId[80]: Did Not Pass Certificate Validation
search cancel

Health Check FailureId[20]: Could Not Check Revocation or FailureId[80]: Did Not Pass Certificate Validation

book

Article ID: 287124

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

  • Agent generating Events for Health Check FailureId[20] similar to:
    Carbon Black App Control Agent detected a problem: c:\program files (x86)\bit9\parity agent\parity.exe is signed but could not check revocation: Error[800B010E]. Options[00000003] TotalFailures[1] FailureId[20]
  • Agent generating Events for Health Check FailureId[80] similar to:
    Carbon Black App Control Agent detected a problem: C:\Windows\system32\userinit.exe is signed but did not pass certificate validation: Error[800B010E]. Options[00000003] TotalFailures[2] FailureId[80]
    

Environment

  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions

Cause

These Low Severity Health Check Events are caused in limited or no connectivity environments due to the endpoint being unable to establish a connection with the issuing Certificate Authority to complete the Certificate Revocation List checks.

 

Resolution

Internet Connected Endpoints:

Work with the network team to validate communication to the Certificate Authority's Distribution Point is open and working.

  • It's possible the Windows Cryptographic API was temporarily unable to reach the Certificate Authority due to a firewall, proxy restriction or temporary loss of Internet access while the check is being made.
  • If using a Proxy, the 32-bit Proxy settings may not be set correctly.

Air Gapped (or otherwise limited) Endpoints:

Additional Information

  • The Health Check Event Guide categorizes these failures as Low Severity, and they do not impact the overall functionality of the Agent.
  • When an endpoint is not connected to the Internet the operating system will rely on the existing local cache of Certificate Revocation Lists.