How to verify if certificates created by CB EDR server are synchronized with EDR Sensors

Products

• Carbon Black EDR

Issue/Introduction

Verify certificate synchronization between the Carbon Black EDR server and endpoint sensors when troubleshooting offline status.

Environment

• Carbon Black EDR Server: All Supported Versions
• Carbon Black EDR Sensor: Supported Versions
• Microsoft Windows OS: Supported Versions
• Linux OS: Supported Versions

Resolution

1. Carbon Black EDR Server certificate:
   1. Check if the fingerprint of the server certificate is the same in both the EDR Server and the EDR Sensor at the endpoint side:
      1. Server side check:

         [root@EDR-Server tmp]#  openssl x509 -noout -fingerprint -sha1 -in /etc/cb/certs/cb-server.crt
         SHA1 Fingerprint=63:ED:DF:DD:1D:9D:8D:E7:D7:97:70:D7:ED:74:D7:D8:46:14:82:9A
         [root@EDR-Server ~]# psql -d cb -p 5002 -c "SELECT sg.name AS sensor_group_name, sc.name AS server_cert_name, sc.thumbprint FROM public.sensor_groups sg JOIN public.server_certs sc ON sg.server_cert_id = sc.id;"
           sensor_group_name   | server_cert_name |                         thumbprint
         ----------------------+------------------+-------------------------------------------------------------
          Default Group        | Legacy           | 63:ED:DF:DD:1D:9D:8D:E7:D7:97:70:D7:ED:74:D7:D8:46:14:82:9A
          GroupWithWin10       | Legacy           | 63:ED:DF:DD:1D:9D:8D:E7:D7:97:70:D7:ED:74:D7:D8:46:14:82:9A
         .....Omitted.....
          test                 | Temp_cert        | DE:A4:0F:F3:7A:8D:8B:96:DC:D7:5C:6B:76:36:F1:96:25:FF:7A:7C
          LinuxTests           | Legacy           | 63:ED:DF:DD:1D:9D:8D:E7:D7:97:70:D7:ED:74:D7:D8:46:14:82:9A

         1. From above outputs, the first command is to check what is the server side certificate thumbprint, and the second command is to check which server certificate is assigned to the interesting sensor group
      2. Endpoint side:

         1. Windows:

            C:\Windows\System32>reg query "HKLM\SOFTWARE\CarbonBlack\Config" /v ServerThumbprint
            HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack\Config
                ServerThumbprint    REG_SZ    63EDDFDD1D9D8DE7D79770D7ED74D7D84614829A

         2. Linux:

            sudo sqlite3 /var/opt/carbonblack/response/carbonblack.db "SELECT value FROM settings WHERE name='ServerCert';" | openssl x509 -noout -fingerprint -sha1

            1. From above, we can see that the Server Thumbprint string is the same in both sides, hence we can conclude that the server certificate is in sync.
2. Carbon Black EDR Sensor group certificate:
   1. Below one liner will print out a table of all sensor groups along their respective Sensor group certificate (singed by cb-ca-client) thumbprint and the revocation status, if a certain group will happen to have two entries, one of these certificates will be the currently active certificate, and the other one is the previously revoked certificate

      [root@EDR-Server tmp]#  psql -p 5002 cb -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;" && psql -p 5002 cb -t --csv -c "SELECT sg.name, upper(encode(digest(decode(regexp_replace(regexp_replace(scc.x509_cert, '-----(BEGIN|END) CERTIFICATE-----', '', 'g'), '\s+', '', 'g'), 'base64'), 'sha1'), 'hex')), CASE WHEN scc.revocation_time IS NULL THEN 'Active' ELSE 'Revoked' END FROM sensor_groups sg LEFT JOIN sensor_client_certs scc ON scc.sensor_group_id = sg.id;" | sed '1i Group Name,Fingerprint (SHA1),Revocation_Status' | column -s, -t && psql -p 5002 cb -c "DROP EXTENSION IF EXISTS pgcrypto;"
      CREATE EXTENSION
      Group Name            Fingerprint (SHA1)                        Revocation_Status
      Default Group         3DB2C1D3B3624D155E3A2E5CBFBA3D0DF78C5B8C  Active
      GroupWithWin10        AB003072DB1412DDEDB6F64CC15AE4382952B335  Active
      .....Omitted.....
      test                  31B68EB6C3C98A2537C18DA5CA7B7C7B9F3FA6D0  Active
      LinuxTests            19454DC446EAF367EF94B0D8CAB1809A0E31248F  Active
      DROP EXTENSION

   2. Compare the fingerprint of the sensor group to the fingerprint of the group certificate used by the sensor in the endpoint side:
      1. Windows:

         C:\Windows\System32>reg query "HKLM\SOFTWARE\CarbonBlack\Config" /v sensorThumbprint
         HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack\Config
             sensorThumbprint    REG_SZ    3DB2C1D3B3624D155E3A2E5CBFBA3D0DF78C5B8C

      2. Linux:

         sudo sqlite3 /var/opt/carbonblack/response/carbonblack.db "SELECT value FROM settings WHERE name='ClientCert';" | openssl x509 -noout -fingerprint -sha1

         echo | openssl s_client -connect <EDR_SERVER_IP_OR_FQDN>:443 -showcerts 2>/dev/null | openssl x509 -noout -fingerprint -sha1

         1. By running either of the above commands, it is possible to conclude that the sensor has the right certificate assigned to "Default Group", as this sensor is a member of this group.