CAS fails to submit samples to the Cloud Sandbox

Products

• CAS-VA
• Content Analysis Software
• ISG Content Analysis

Issue/Introduction

You have an active CAS Cloud Sand box subscription and completed required configuration steps to enable the feature. However CAS fails to submit samples to the Cloud Sandbox and the following errors are observed in CAS debug logs:

warning avservice[7576]: WARNING  : SymcCloudApi::catch_symcCloud - Curl failure 58
err avservice[7576]: ERROR    : SandboxingSymcCloud::Submit Dummy.pdf - query_hash failed
debug avservice[7576]: DEBUGGING: Sandboxes::Submit: sandbox->Submit returned 3
err avservice[7576]: ERROR    : Sandboxes::Submit: failed to submit Dummy.pdf for Symantec Cloud Sandboxing sandboxing
debug avservice[7576]: DEBUGGING: Sandboxing is complete, any wait timers have been canceled

Environment

• CAS appliance with an active Cloud Sandboxing subscription 
• Cloud Sandboxing is enabled and configured in the CAS

Cause

CAS Cloud Sandboxing client registers in the Cloud Sandboxing backend when you enable/configure the feature. Upon registration completion CAS client gets client certificate/key which are required for Cloud API sandbox submissions. If registration process is interrupted certificate/key might be missing/incorrect on the client side. Error code 58 indicates that:

CURLE_SSL_CERTPROBLEM (58) problem with the local client certificate.

Resolution

Reset Cloud Sandboxing settings in the CAS by disabling the feature and deactivating subscription. After that re-enable subscription/feature and configure it from scratch to trigger new cloud registration. That should resolve the issue with the client certificate/key.