Sometimes we see the agent connect to the LimaCharlie cloud, enrolls, then disconnects (which is normal the first time after enrollment) and never connects again, or it doesn't show that kernel has been acquired.

This behavior is typical with SSL interception. Sometimes it's a network device, but at other times some security products on the host can do that without being very obvious.

You can confirm if there is SSL interception by performing the following steps to check the SSL fingerprint of the LimaCharlie cloud from the host.

Confirm the region of your organization

If you already know where your organization's region is located, you can move to the next step. To verify the organization's region where the data is processed and stored, click Add Sensor from the Sensors view.

You will then see the region listed under Sensor Connectivity.

Open the test URL

Via web browser, navigate to one of the below test URLs that corresponds to the correct region:

No website will open; you should get a "Your connection is not private" type of message instead.

Display the SSL Certificate

By clicking near the URL bar on the exclamation mark, you will open a small menu and you can click something like "Certificate status"/"Certificate validity"/"Certificate is not valid" which will display the certificate information.

Confirm the SHA-1 and SHA-256 fingerprints

The SHA-1 and SHA-256 fingerprints should match the values below that correspond to the region your organization is in.

If the SHA-1 and SHA-256 fingerprints you are seeing do not match what's listed below, that's an indicator of the SSL interception.

Region

SHA-256 Fingerprint

SHA-1 Fingerprint

US

14 44 8C B6 A1 19 A5 BE 18 AE 28 07 E3 D6 BD 55
B8 7A 5E 0C 3F 2D 78 03 6E 7C 6A 2A AA 45 8F 60

1A 72 67 08 D0 83 7D A9 62 85 39 55 A1 12 1B 10
B0 F4 56 1A

UK

49 49 B0 41 D6 14 F3 3B 86 BF DF 14 24 F8 BD 2F
E1 98 39 41 5A 99 E6 F1 C7 A2 C8 AB 34 0C FE 1D

2E 49 00 DB F8 3A 2A 88 E0 15 76 D5 C5 4F 8F F3
7D 27 77 DD

India

68 6F 08 3D 53 3F 08 E0 22 EB F6 67 0C 3C 41 08
75 D6 0E 67 03 88 D9 B6 E1 F8 19 6B DA 54 5A A3

37 57 DD 4E CF 2B 25 0B CA EA E2 E6 E3 B2 98 48
29 19 F3 6B

Europe

EF B3 FA A7 78 AB F0 B0 41 00 CF A3 5F 44 3F 9A
4D 16 28 B9 83 22 85 E3 36 44 D5 DC F9 5C 78 5B

07 72 B3 31 1A 89 D6 54 1D 71 C3 07 AD B5 8A 26
FD 30 7E 5D

Canada

D3 40 8B 59 AE 5A 28 75 D1 65 71 50 52 2E 6F 45
26 EE E8 19 3A 9A 74 39 C1 64 60 B8 6A 92 15 47

E3 EF AE 6A 0E 7F 18 83 15 FE F2 02 6C F3 2D 4E
59 95 4D 0A

If this does not address the problem, check additional troubleshooting information here & contact LimaCharlie support if this does not help to get it resolved.

Did this answer your question?