EDR: How to View Sensor Communication Certificates on Windows Sensors 6.2.3 and Above

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to view the certificates used for sensor communication

Environment

• EDR Sensors: 6.2.3 and Higher
• Microsoft Windows: All Supported Versions

Resolution

1. On the endpoint, run mmc.exe
2. File > Add/Remove Snap-in..
   • 
3. Click Certificates then Add Certificates (Local Computer)
   • 
4. Under the Certificates path a CarbonBlack folder is created upon installing the sensor
   • 

Additional Information

• Client Certs are based upon the Sensor Group the endpoint is in
• By Default, the legacy self-signed certificates is used. If using a custom server certificate and it's assigned to the sensor group, the custom certificate will be replace the self-signed in the CarbonBlack certificate folder