Sensor Auto-upgrade feature doesn't work due to Error: DataEncryptor failed update during sensor upgrade

Products

• Carbon Black EDR

Issue/Introduction

Carbon Black EDR sensors fail to upgrade from version any version to any version using the console upgrade group method. While manual upgrades using the installation package are successful, console-based upgrades do not trigger. Log analysis reveals communication failures and certificate mismatches.

Symptoms

• Sensors placed in the Upgrade Group remain at the original version (The version the sensor was placed with in the group initially).
• Sensor logs (sensorServices.log) show the following entries:
  • Tid#### DataEncryptor failed update after client certificate swap.
  • Tid#### Failed to read config value (SensorThumprint) from registry (Note: typo 'SensorThumprint' is expected in specific versions).
• Server logs indicate No client cert supplied or client cert does not match expected cert.

Environment

• Product: Carbon Black EDR
• Server Version: any version
• Sensor Version: any version
• OS: any OS

Cause

The issue occurs when client certificate enforcement and revocation checks are disabled on the EDR server (e.g., EnforceClientCertRevocation=False and ssl_verify_client off). When these security checks are disabled, the auto-upgrade feature fails to secure the necessary communication channel to perform the swap.

 

 

Resolution

Re-enable client certificate enforcement and revocation checks on the EDR server.

1. Log in to the EDR server with root or administrator privileges.
2. Revert any manual changes made to the SSL configuration to ensure EnforceClientCert is set to True and comment out EnforceClientCertRevocation=False.
   

   In /etc/cb/cb.conf
   
   update 
   
   EnforceClientCerts=True
   # EnforceClientCertRevocation=False

3. Ensure ssl_verify_client is configured correctly in the server settings, by changing off to optional.
   

   edit /etc/cb/nginx/conf.d/includes/cb.server.base_sensor. Update line 2 (ssl_verify_client) from off to optional
   
       ssl_verify_client       optional;

4. Restart EDR server/cluster
   

   standalone
   /usr/share/cb/cbservice cb-enterprise restart
   
   cluster
   /usr/share/cb/cbcluster stop && /usr/share/cb/cbcluster start

5. Once certificate communication is secured, re-attempt the sensor upgrade via the console Upgrade Group.

Additional Information

To receive updates on this topic, subscribe to the article following the steps in How to subscribe to a Knowledge Article .

Regenerating a New Set of Certificates for Sensor to Server Communication when the Originals Expire