EDR: How to display installed certificates on an OSX sensor

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• EDR OSX Sensor: 6.2.7+

Resolution

• The OSX sensor stores the certificates in a separate keychain file: /Library/Keychains/carbonblack.keychain
• It needs to be opened separately of the User's keychain file to view the installed EDR certificates:
  • Open Keychain Access Utility on the sensor in question.
  • Right click the Keychains pane and select 'Add Keychain'
    • 
  • Browse to the /Library/Keychains/ directory and choose the carbonblack.keychain file to open: 
    • 
  • Select the carbonblack keychain in the Keychains pane:
    • 
  • We can now double click the certificates in question to confirm their fingerprints, issuer, serial, etc.