Access official resources from Carbon Black experts
Advanced Search
IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!
The App Control Agent requires validation of both the Code Signing (File Publisher) and the Counter Signature (Timestamping) certificates for successful Publisher Approval of a file
This validation process works by querying Windows Cryptographic API and there could be many reasons why Windows Crypto API would return errors
Resolution
App Control Server 8.10 introduced the ability to find and approve the counter signature from the Console.
In 8.9 and below it's not possible to search & find the Counter Signature info via the Console, and a query of the database is needed.
Server 8.10.0+
Click the File Hash in the Description of the Block Event.
From the File Details page > File Properties > click the Certificate shown in Countersigner Certificate.
Copy the Thumbprint shown (Example: 8d45082f8a6e5ab1b2526844050e874f26d91c0c)
Click the Publisher name.
Expand All Certificates For This Publisher
Click Show Filters > Thumbprint > is: <paste the Thumbprint>
Check the box > Action > Approve Certificate(s)
Server 8.9.6 and below:
Log in to the application server hosting the App Control Console as the Carbon Black Service Account.
Launch SQL Server Management Studio and using the SHA256 hash from the Block Event, execute the following query(replacing 'SHA256HERE' with the actual hash):
use das;
select publisher_id, subject_name, serial_number, thumbprint, valid_from, valid_to from dbo.certificates (nolock)
where cert_id in (select timestamp_cert_id from dbo.antibodies with (nolock) where hash = 'SHA256HERE');
This should return a single row containing the Publisher ID and information for the certificate that caused the block event
Using the Publisher_Id update then navigate to the following URL:
