EDR: Sensors no longer checking in after migration to new server

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensor checks into the server once and never again
• sensorcomms.log shows HResult - 0x80190190, which translates to Facility[25] Code[0190] Severity[1] Bad request (400).
• nginx access.log shows HTTP 400 responses

Environment

• EDR (formerly Cb Response) Server: All Versions

Cause

The cb-client-ca certificates were changed after group certificates were already created.

Resolution

1. Revoke previous sensor group certificates: https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-revoke-a-sensor-group-certificate-version-6-2/ta-p/69193
2. Any sensors already connected to the server will need to be uninstalled and re-installed