Endpoint Standard: Mirror server will not connect over HTTPS

[#1]

Environment

• Carbon Black Cloud Console: All Versions
  • Endpoint Standard
• Carbon Black Cloud Mirror Server Utility: v3.0
  • Microsoft Windows: All Supported Versions

Symptoms

• Mirror Servers will not update over HTTPS
• Wireshark capture shows connection attempts to updates2.cdc.carbonblack.io using TLS 1.0 
• 0 files downloaded

Cause

As of February 2022, we now require TLS 1.2 for connections made to updates2.cdc.carbonblack.io

Resolution

Adding "--no-dns-resolve" to the command lines in the do_update_ssl.bat or update_defs_ssl.sh script ensures that TLS 1.2 will be used to make the connection. Example(s)

Linux

Linux -> retry ./avupdate.bin --mirror --no-dns-resolve --no-config --internet-srvs=https://updates2.cdc.carbonblack.io/update2…

Windows

upd.exe --mirror --no-dns-resolve --no-config --update-modules-list=VDF,AVE2 --master-file=/idx/master.idx --product-file=/idx/savapi4lib-win32-en.info.gz ...

 
 

Related Content

Carbon Black Cloud backend will deprecate TLS 1.0 & 1.1 protocols
Cb Defense: How to configure Local Mirror Server on Windows to use a proxy
Endpoint Standard: How to configure a Local Mirror (Windows)
Endpoint Standard: Local Mirror Server for Signature Updates
Cb Defense: How to configure Local Mirror Server on Linux to use a proxy