What are some concerns with disabling the CRL check within the Sensor?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Endpoint Standard

Issue/Introduction

What is the concern with disabling the CRL check within the Sensor?

Environment

• Carbon Black Cloud Windows Sensor: Version 3.3.x.x and Higher
• Microsoft Windows: All Supported Versions

Resolution

• The benefit of the CRL check is that it would automatically prevent the sensor from communicating with the CBC backend in the exceptional situation that the CBC certificate was revoked.
• Carbon Black would be immediately involved in the revocation process. Carbon Black would notify all customers proactively if certificate revocation was required.
• This would allow customers to take action if the CRL check was disabled.

Additional Information

• Sensor can also be configured to make a best effort CRL check