Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Sensor won't connect to server with SSL Connect Error 0x80c80023

Sensor won't connect to server with SSL Connect Error 0x80c80023

Version

All versions of Cb Response

Issue

A Cb Response sensor fails to connect to the Carbon Black server

Symptoms

The following is logged in the Sensor.LOG:

Pid[3A78] Tid[3B84] 2015-11-20 16:23:16 CbServer::_Synch : failed to register HrError[0x80C80023]

Pid[3A78] Tid[3B84] 2015-11-20 16:23:16 CbServer::_Synch : failed to register HrError[0x80C80023]

Or the HRESULT is 0x80C80023 in sensor_comms.log

Cause

0x80C80023 CURL Error - CURLE_SSL_CONNECT_ERROR - A problem occurred somewhere in the SSL/TLS handshake. You really want the error buffer and read the message there as it pinpoints the problem slightly more. Could be certificates (file formats, paths, permissions), passwords, and others.

Solution

Check if a proxy is blocking communication between the sensor and the Carbon Black server.

Forward Proxy

If this is for a forward proxy this can be resolved with a configuration change on the sensor. The sensorsettings.ini file can be modified to include the following "Proxy" parameter:

Proxy:[host]:[port]

Reverse Proxy

If this is for a reverse proxy, this will need to be fixed on the network. Make sure that the communication between the sensor and the Cb Response server is allowed through the proxy. If that doesn't work, do a Wireshark analysis to determine why the connection failed.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-04-2016
Views:
3895
Contributors