Version
All versions of Cb Response
Issue
A Cb Response sensor fails to connect to the Carbon Black server
Symptoms
The following is logged in the Sensor.LOG:
Pid[3A78] Tid[3B84] 2015-11-20 16:23:16 CbServer::_Synch : failed to register HrError[0x80C80023] Pid[3A78] Tid[3B84] 2015-11-20 16:23:16 CbServer::_Synch : failed to register HrError[0x80C80023] |
Or the HRESULT is 0x80C80023 in sensor_comms.log
Cause
0x80C80023 CURL Error - CURLE_SSL_CONNECT_ERROR - A problem occurred somewhere in the SSL/TLS handshake. You really want the error buffer and read the message there as it pinpoints the problem slightly more. Could be certificates (file formats, paths, permissions), passwords, and others.
Solution
Check if a proxy is blocking communication between the sensor and the Carbon Black server.
Forward Proxy
If this is for a forward proxy this can be resolved with a configuration change on the sensor. The sensorsettings.ini file can be modified to include the following "Proxy" parameter:
Reverse Proxy
If this is for a reverse proxy, this will need to be fixed on the network. Make sure that the communication between the sensor and the Cb Response server is allowed through the proxy. If that doesn't work, do a Wireshark analysis to determine why the connection failed.
