Carbon Black Cloud: What will Trigger the CRL (Certificate Revocation List) Check from Sensor?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• When does a sensor trigger the CRL check?
• What kind of events may trigger a CRL check?
• How frequently will the CRL check happen? 

Environment

• Carbon Black Cloud Sensor: 3.3.x and Higher versions
• Windows OS: All Supported Versions

Resolution

• Windows will perform a CRL check every time a certificate is checked.
• As regards the specific CRL check that led to a "CURL_CRL_CHECK" message, this happens at every sensor check in.
• WinSSL will keep a cache of the CRL results for a period of time which will not require an online CRL validation.