EDR: How to View Sensor Communication Certificates on Windows Sensors 6.2.3 and Above
book
Article ID: 287949
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How to view the certificates used for sensor communication
Environment
EDR Sensors: 6.2.3 and Higher
Microsoft Windows: All Supported Versions
Resolution
On the endpoint, run mmc.exe
File > Add/Remove Snap-in..
Click Certificates then Add Certificates (Local Computer)
Under the Certificates path a CarbonBlack folder is created upon installing the sensor
Additional Information
Client Certs are based upon the Sensor Group the endpoint is in
By Default, the legacy self-signed certificates is used. If using a custom server certificate and it's assigned to the sensor group, the custom certificate will be replace the self-signed in the CarbonBlack certificate folder