Enable Agent Key Pinning (macOS)

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to enable Public Key Pinning for macOS Agents.

Environment

• App Control Server: 8.7.0 and higher
• App Control macOS Agent: 8.9.2 and higher

Resolution

Enable Public Key Pinning:

1. Upgrade to macOS Agent 8.9.2 or higher.
2. Log in to the Console and navigate to: https://ServerAddress/agent_config.php
3. Click Add Agent Config and use the following details:
   • Name: Public Key Pinning (macOS)
   • Host ID: 0
   • Value:

     use_http_public_key_pinning_mac=1

   • Platform: Mac
   • Status: Enabled
4. Click Save

After Enabling Public Key Pinning:

• It is recommended to regenerate the Policy Installers to be sure the new setting & files are included in new deployments.
• After receiving this Agent Config, existing Agents will automatically download and import the TrustedCertList.pem and Keychain.json files.
  • Agents will download these files via the Resource Download Location.
  • If necessary, the files can be imported manually.