EDR: Sensors no longer checking in after migration to new server

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensor checks into the server once and never again
• sensorcomms.log shows HResult - 0x80190190, which translates to Facility[25] Code[0190] Severity[1] Bad request (400).
• nginx access.log shows HTTP 400 responses

Environment

• EDR (formerly Cb Response) Server: All Versions

Cause

The cb-client-ca certificates were changed after group certificates were already created.

Resolution

1. Revoke previous sensor group certificates
2. Any sensors already connected to the server will need to be uninstalled and re-installed