App Control: Check Point File Analysis Returning "Could Not Establish Trust Relationship for the SSL/TLS Secure Channel"
book
Article ID: 290593
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
After attempting to analyze files the error "The underlying connection was closed. Could not establish trust relationship for the SSL/TLS secure channel" is displayed in the Error column on the Analyzed Files page.
Environment
App Control Server: 8.x and Greater
Microsoft Windows Server: All Supported Versions
Check Point: All Supported Versions
Cause
After the inital 8.0.x release SSL/TLS certificate checks on file uploads are honored. Thus, certificates that are not trusted can cause the connector to fail.
Resolution
Navigate in a browser to https://YOURSERVER/Support.php
Enable Server Diagnostics, with the Server and Reporter logging to High. Script and SQL collection not required.
Once enabled, test the connection under the System Configuration (GEAR Icon) > Administration > Connectors page.
Analyze a file.
Log into the Cb Protection application server as the service account user.
Confirm that the latest file analysis has failed.
Navigate on the server to C:\Program Files (x86)\Bit9\Parity Server\Reporter and open the most recent ReporterLog.bt9 file. Scroll to the bottom and copy the full URL it's requesting.
On the server, open the URL in Internet Explorer. You will likely see a certificate related error.
Import your Check Point certificate into the computers Trusted Root Certification Authority using the MMC snap-in. Please note the Subject name of the certificate.
Verify that you can ping the Subject name of the certificate. If no routing is enabled, you can add it to your DNS or modify the server Host file to include the route.
Navigate back to the System Configuration (GEAR Icon) > Administration > Connectors page, and make sure the Checkpoint File analysis IP matches the name found in your Check Point certificate.