EDR: How to display installed certificates on an OSX sensor
book
Article ID: 287410
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Resolution
- The OSX sensor stores the certificates in a separate keychain file: /Library/Keychains/carbonblack.keychain
- It needs to be opened separately of the User's keychain file to view the installed EDR certificates:
- Open Keychain Access Utility on the sensor in question.
- Right click the Keychains pane and select 'Add Keychain'
- Browse to the /Library/Keychains/ directory and choose the carbonblack.keychain file to open:
- Select the carbonblack keychain in the Keychains pane:
- We can now double click the certificates in question to confirm their fingerprints, issuer, serial, etc.
Feedback
thumb_up
Yes
thumb_down
No