Mailing List Archive: [clamav-users] FreshClam can't download database

It looks like the SSL cert for database.clamav.net expired in October of
last year.

ClamAV update process started at Wed Feb 24 21:42:46 2021
daily database available for download (remote version: 26090)
WARNING: Download failed (77) WARNING: Message: Problem with the SSL CA
cert (path? access rights?)
WARNING: getcvd: Can't download daily.cvd from
https://database.clamav.net/daily.cvd
Trying again in 5 secs...
daily database available for download (remote version: 26090)

echo -n | openssl s_client -showcerts -connect database.clamav.net:443 |
openssl x509 -text -noout
depth=1 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN =
AddTrust External CA Root
verify error:num=10:certificate has expired
notAfter=May 30 10:48:38 2020 GMT
verify return:0
depth=1 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN =
AddTrust External CA Root
verify error:num=10:certificate has expired
notAfter=May 30 10:48:38 2020 GMT
verify return:0
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN =
AddTrust External CA Root
verify error:num=10:certificate has expired
notAfter=May 30 10:48:38 2020 GMT
verify return:0
DONE
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
e7:28:4e:d7:e1:29:eb:04:df:95:78:6a:e4:cd:8a:d0
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA
Limited, CN=COMODO ECC Domain Validation Secure Server CA 2
Validity
Not Before: Apr 6 00:00:00 2020 GMT
Not After : Oct 13 23:59:59 2020 GMT
Subject: CN=ssl392509.cloudflaressl.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:0c:b2:3d:e1:a0:35:46:7b:0c:30:95:c6:62:17:
5d:b1:a0:04:71:27:f5:d7:30:4b:fa:fa:db:ec:5f:
20:c3:58:dc:12:cc:b2:62:31:f1:1e:5e:99:8f:dd:
43:f4:f9:1a:45:17:e3:a8:88:31:30:bd:f1:be:87:
bc:5a:d6:f0:f2
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Authority Key Identifier:

keyid:40:09:61:67:F0:BC:83:71:4F:DE:12:08:2C:6F:D4:D4:2B:76:3D:96

X509v3 Subject Key Identifier:
0E:85:B3:45:D0:81:69:D0:98:5D:65:83:49:60:2C:70:4B:49:77:72
X509v3 Key Usage: critical
Digital Signature
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.6449.1.2.2.7
CPS: https://sectigo.com/CPS
Policy: 2.23.140.1.2.1

X509v3 CRL Distribution Points:

Full Name:
URI:
http://crl.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crl

Authority Information Access:
CA Issuers - URI:
http://crt.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crt
OCSP - URI:http://ocsp.comodoca4.com

1.3.6.1.4.1.11129.2.4.2:

......w...\..}h.....#....W|W..j..a:.i......qP........H0F.!...O,..rXl.
Er\n}.o|..'ju..T.g....!..pNPz.I..@!K"....Xb.({....h.
..V.w.....7~.b....a...{7.V..&[...K.ATn...qP........H0F.!..S.;..!~..lc..c:W..47tjg.j..XJ
..!....0'].....Di&fHZ].......7.=x..-
X509v3 Subject Alternative Name:
DNS:ssl392509.cloudflaressl.com
Signature Algorithm: ecdsa-with-SHA256
30:45:02:20:70:19:15:5f:c3:a1:ba:50:36:73:d8:40:1d:4b:
e1:90:99:54:8d:18:d5:17:64:46:93:1d:d9:92:b3:3d:18:1f:
02:21:00:ee:69:3b:08:e6:b5:5a:31:0b:b5:25:5d:3c:65:63:
d3:7f:6d:44:24:28:ac:e8:bf:87:02:67:13:29:93:ed:e6
--
Easy, fast GUI development.
http://PerlQt.wikidot.com

You’re not sending “server-name” in your test there:

echo | openssl s_client -connect database.clamav.net:443 -servername database.clamav.net | openssl x509 -text -noout

> On Feb 24, 2021, at 5:05 PM, Royce Souther via clamav-users <clamav-users@lists.clamav.net> wrote:
>
> It looks like the SSL cert for database.clamav.net <http://database.clamav.net/> expired in October of last year.
>
> ClamAV update process started at Wed Feb 24 21:42:46 2021
> daily database available for download (remote version: 26090)
> WARNING: Download failed (77) WARNING: Message: Problem with the SSL CA cert (path? access rights?)
> WARNING: getcvd: Can't download daily.cvd from https://database.clamav.net/daily.cvd <https://database.clamav.net/daily.cvd>
> Trying again in 5 secs...
> daily database available for download (remote version: 26090)
>
>
> echo -n | openssl s_client -showcerts -connect database.clamav.net:443 <http://database.clamav.net:443/> | openssl x509 -text -noout
> depth=1 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
> verify error:num=10:certificate has expired
> notAfter=May 30 10:48:38 2020 GMT
> verify return:0
> depth=1 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
> verify error:num=10:certificate has expired
> notAfter=May 30 10:48:38 2020 GMT
> verify return:0
> depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
> verify error:num=10:certificate has expired
> notAfter=May 30 10:48:38 2020 GMT
> verify return:0
> DONE
> Certificate:
> Data:
> Version: 3 (0x2)
> Serial Number:
> e7:28:4e:d7:e1:29:eb:04:df:95:78:6a:e4:cd:8a:d0
> Signature Algorithm: ecdsa-with-SHA256
> Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO ECC Domain Validation Secure Server CA 2
> Validity
> Not Before: Apr 6 00:00:00 2020 GMT
> Not After : Oct 13 23:59:59 2020 GMT
> Subject: CN=ssl392509.cloudflaressl.com <http://ssl392509.cloudflaressl.com/>
> Subject Public Key Info:
> Public Key Algorithm: id-ecPublicKey
> Public-Key: (256 bit)
> pub:
> 04:0c:b2:3d:e1:a0:35:46:7b:0c:30:95:c6:62:17:
> 5d:b1:a0:04:71:27:f5:d7:30:4b:fa:fa:db:ec:5f:
> 20:c3:58:dc:12:cc:b2:62:31:f1:1e:5e:99:8f:dd:
> 43:f4:f9:1a:45:17:e3:a8:88:31:30:bd:f1:be:87:
> bc:5a:d6:f0:f2
> ASN1 OID: prime256v1
> NIST CURVE: P-256
> X509v3 extensions:
> X509v3 Authority Key Identifier:
> keyid:40:09:61:67:F0:BC:83:71:4F:DE:12:08:2C:6F:D4:D4:2B:76:3D:96
>
> X509v3 Subject Key Identifier:
> 0E:85:B3:45:D0:81:69:D0:98:5D:65:83:49:60:2C:70:4B:49:77:72
> X509v3 Key Usage: critical
> Digital Signature
> X509v3 Basic Constraints: critical
> CA:FALSE
> X509v3 Extended Key Usage:
> TLS Web Server Authentication, TLS Web Client Authentication
> X509v3 Certificate Policies:
> Policy: 1.3.6.1.4.1.6449.1.2.2.7
> CPS: https://sectigo.com/CPS <https://sectigo.com/CPS>
> Policy: 2.23.140.1.2.1
>
> X509v3 CRL Distribution Points:
>
> Full Name:
> URI:http://crl.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crl <http://crl.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crl>
>
> Authority Information Access:
> CA Issuers - URI:http://crt.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crt <http://crt.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crt>
> OCSP - URI:http://ocsp.comodoca4.com <http://ocsp.comodoca4.com/>
>
> 1.3.6.1.4.1.11129.2.4.2:
> ......w...\..}h.....#....W|W..j..a:.i......qP........H0F.!...O,..rXl. Er\n}.o|..'ju..T.g....!..pNPz.I..@!K"....Xb.({....h. ..V.w.....7~.b....a...{7.V..&[...K.ATn...qP........H0F.!..S.;..!~..lc..c:W..47tjg.j..XJ
> ..!....0'].....Di&fHZ].......7.=x..-
> X509v3 Subject Alternative Name:
> DNS:ssl392509.cloudflaressl.com <http://ssl392509.cloudflaressl.com/>
> Signature Algorithm: ecdsa-with-SHA256
> 30:45:02:20:70:19:15:5f:c3:a1:ba:50:36:73:d8:40:1d:4b:
> e1:90:99:54:8d:18:d5:17:64:46:93:1d:d9:92:b3:3d:18:1f:
> 02:21:00:ee:69:3b:08:e6:b5:5a:31:0b:b5:25:5d:3c:65:63:
> d3:7f:6d:44:24:28:ac:e8:bf:87:02:67:13:29:93:ed:e6
> --
> Easy, fast GUI development.
> http://PerlQt.wikidot.com <http://perlqt.wikidot.com/>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

Mailing List Archive

Mailing List Archive

Attached Files: