EDR: How to display installed certificates on an OSX sensor
search cancel

EDR: How to display installed certificates on an OSX sensor

book

Article ID: 287410

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • EDR OSX Sensor: 6.2.7+

Resolution

  • The OSX sensor stores the certificates in a separate keychain file: /Library/Keychains/carbonblack.keychain
  • It needs to be opened separately of the User's keychain file to view the installed EDR certificates:
    • Open Keychain Access Utility on the sensor in question.
    • Right click the Keychains pane and select 'Add Keychain'
      • User-added image
    • Browse to the /Library/Keychains/ directory and choose the carbonblack.keychain file to open: 
      • User-added image
    • Select the carbonblack keychain in the Keychains pane:
      • User-added image
    • We can now double click the certificates in question to confirm their fingerprints, issuer, serial, etc.