Carbon Black Cloud: Installation of or Upgrade to 3.7+ Fails With Error: Cannot Install on Operating Systems Without the Sha256 Code Signing Update

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Sensor installation and/or upgrade to 3.7 fails
• Install or upgrade log shows:

  ERROR     Custom Action CAInstallPreCheck failed.  Cannot install on Operating Systems without the Sha256 code signing update. Return code : 1603

Environment

• Carbon Black Cloud Sensor: 3.7+
• Microsoft Windows Windows 7, Windows 7 SP1
• Microsoft Windows Server 2008 R2, Windows Server 2008 R2 SP1

Cause

Microsoft is no longer providing SHA-1 code signing for our Windows sensor releases. Going forward, Microsoft will code sign our Carbon Black Cloud Windows sensor releases using only SHA-2 hash algorithms.

Resolution

Apply the required Microsoft update
https://support.microsoft.com/en-us/topic/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus-64d1c82d-31ee-c273-3930-69a4cde8e64f

Additional Information

https://community.carbonblack.com/t5/Carbon-Black-Cloud-Discussions/CBC-Windows-SHA-2-Windows-Updates-Required-for-Continued-Support/td-p/103772