Carbon Black Cloud: What will Trigger the CRL (Certificate Revocation List) Check from Sensor?

[#1]

Environment

• Carbon Black Cloud Sensor: 3.3.x and Higher versions
• Windows OS: All Supported Versions

Question

• When does a sensor trigger the CRL check?
• What kind of events may trigger a CRL check?
• How frequently will the CRL check happen? 

Answer

• Windows will perform a CRL check every time a certificate is checked.
• As regards the specific CRL check that led to a "CURL_CRL_CHECK" message, this happens at every sensor check in.
• WinSSL will keep a cache of the CRL results for a period of time which will not require an online CRL validation. 

Related Content

Carbon Black Cloud: How To Configure Sensor Not To Require CRL Checks
Carbon Black Cloud: Sensor not connecting via proxy/firewall
CB Defense: Why Are Godaddy's OCSP And CRL Domains Required When Installing A 3.3 + Sensor?