EDR Server 7.9.2 Fails to Start with MD5 Checksum Deprecation Error After Running cbssl utility

Products

• Carbon Black EDR

Issue/Introduction

When running the command /usr/share/cb/cbssl certs --regenerate alliance --rpm <license_rpm> on a Carbon Black EDR 7.9.2 system using an older carbon-black-release RPM, the server license file (/etc/cb/server.lic) may be reverted from the SHA-256 format to the legacy MD5 format.

As a result, the EDR server will fail to start and logs an error similar to:

"MD5 checksum support has been deprecated for security reasons."

Additionally, the utility may unexpectedly update the Yum repository configuration file at /etc/yum.repos.d/CarbonBlack.repo.

Environment

• Product: Carbon Black EDR Server

• Version: 7.9.2 and higher

Cause

The cbssl utility performs an rpm -i operation that can reinstall older license metadata if the provided RPM or the system's carbon-black-release package is not the correct, SHA-256 enabled version for EDR 7.9.2.

Resolution

Apply Hotfix 1 (HF1) for EDR 7.9.2 to migrate the license checksum back to SHA-256.

The HF can be downloaded from support.broadcom.com portal under Carbon Black EDR server 7.9.2. The file is called: (7.9.2-HF1-svr.zip)

Important Pre-installation Steps

1. Stop EDR Services:
   1. Standalone: sudo /usr/share/cb/cbservice cb-enterprise stop
   2. Cluster (Primary Node): sudo /usr/share/cb/cbcluster stop
2. License Check: Ensure the carbon-black-release RPM on the system.
3. Deployment Scope: For cluster deployments, run this hotfix on the Primary node only.

Installation Procedure

Install the Hotfix RPM (7.9.2-HF1-svr-CRE-24354-1-4.noarch.rpm):

sudo rpm -ivh 7.9.2-HF1-svr-CRE-24354-1-4.noarch.rpm

The installation process will:

• Validate the EDR version (7.9.2).

• Verify services are stopped.

• Perform an integrity check via rpm -V.

• Migrate the license checksum to SHA-256 (no-op if already correct).

Post-installation Steps

Restart the CB EDR service:

• Standalone: sudo /usr/share/cb/cbservice cb-enterprise start

• Cluster (Primary Node): sudo /usr/share/cb/cbcluster start

Rollback

A backup of the original license file is created at /etc/cb/server.lic.bak prior to migration.

Warning: Restoring an MD5-checksummed backup on an EDR 7.9.2 system will cause the server to reject the license again. Rollback is only intended for use if the server is being downgraded to a pre-7.9.2 version.

To restore:

sudo cp /etc/cb/server.lic.bak /etc/cb/server.lic