EDR: Sensors no longer checking in after migration to new server
search cancel

EDR: Sensors no longer checking in after migration to new server

book

Article ID: 290546

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Sensor checks into the server once and never again
  • sensorcomms.log shows HResult - 0x80190190, which translates to Facility[25] Code[0190] Severity[1] Bad request (400).
  • nginx access.log shows HTTP 400 responses

Environment

  • EDR (formerly Cb Response) Server: All Versions

Cause

The cb-client-ca certificates were changed after group certificates were already created.

Resolution

  1. Revoke previous sensor group certificates: https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-revoke-a-sensor-group-certificate-version-6-2/ta-p/69193
  2. Any sensors already connected to the server will need to be uninstalled and re-installed