CB Protection: Trusted Directories, Connectors, and File Uploads Not Syncing After Upgrade to 8.x

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Trusted Directories no longer approving files
• File Uploads no longer sending to CB Protection console
• Connectors no longer syncing
• Trace.bt9 log (created during high debug) shows errors similar to "SSLError[20]"

Environment

• CB Protection: 8.x and Higher
• Microsoft Windows: All Supported Versions

Cause

In 8.x, the agent began validating SSL certificates when performing file uploads.

Resolution

1. Upgrade to 8.0 P4 or Higher.
2. If symptoms still occur:
   1. Turn on high debugging:
      • https://community.carbonblack.com/t5/Knowledge-Base/Cb-Protection-How-to-Collect-Agent-Logs-Locally-Windows/ta-p/62597
   2. Check Trace.bt9 file for ssl errors
   3. Navigate to: https://<CbServerName>/agent_config.php
   4. Click "Add Agent Config"
   5. Create configuration with properties:
      • Property Name: Name: EP-1458 (Or any name of choice)
      • Host ID: 0
      • Value: upload_ssl_errors_to_ignore=20 (Or any SSL error(s) found)
      • Status: Enabled

Additional Information

• In 8.0 Patch 4, when in basic SSL mode the certificate restrictions have been relaxed slightly to prevent this problem in most scenarios. Patch 4 also added the ability to use the new "upload_ssl_errors_to_ignore" agent configuration property.
• If multiple SSL errors are present in trace.bt9 file, the agent configuration property accepts a comma separated list of errors.