Freshclam on windows SSL peer certificate or SSH remote key not found

[clamavuser]

Describe the bug

When running freshclam against database.clamav.net for daily.cvd, the error is reported : SSL peer certificate or SSH remote key not found

How to reproduce the problem

execute freshclam.exe on windows

Checking configuration files in D:\ClamAV

Config file: clamd.conf

LogFile = "D:\ClamAV\logs\clamd.txt"
LogFileMaxSize = "5242880"
LogTime = "yes"
LogClean = "yes"
LogRotate = "yes"
DatabaseDirectory = "D:\ClamAV\database"
TCPSocket = "3310"
MaxConnectionQueueLength = "20000"
MaxThreads = "100"
ReadTimeout = "10"
CommandReadTimeout = "5"
SendBufTimeout = "200"
MaxQueue = "200"
IdleTimeout = "5"
CrossFilesystems disabled
SelfCheck = "10000"
ExitOnOOM = "yes"

Config file: freshclam.conf

LogTime = "yes"
LogRotate = "yes"
UpdateLogFile = "D:\ClamAV\logs\freshclam.txt"
Checks = "24"
DatabaseMirror = "db.us.clamav.net"

clamav-milter.conf not found

Software settings

Version: 0.104.1
Optional features supported: MEMPOOL AUTOIT_EA06 BZIP2 LIBXML2 PCRE2 JSON RAR

Database information

Database directory: D:\ClamAV\database
WARNING: freshclam.conf and clamd.conf point to different database directories
Total number of signatures: 0

Platform information

uname: Microsoft Windows Server 6.2 SP0.0 Build 9200
OS: Windows, ARCH: AMD64, CPU: AMD64
zlib version: 1.2.11 (1.2.11), compile flags: 65
platform id: 0x10058d8d080000000000077c

Build information

Microsoft Visual C++: (0.7.124)
sizeof(void*) = 8
Engine flevel: 141, dconf: 141

Attachments

If applicable, add screenshots to help explain your problem.

If the issue is reproducible only when scanning a specific file, attach it to the ticket.

[micahsnyder]

Freshclam.exe on Windows uses the system certificate store for the CA certificates to verify the TLS connection to Cloudflare, our CDN for serving the signature databases.

Cloudflare's certs are signed by the Baltimore CyberTrust Root CA, which should appear in your "Rusted Root Certificate Authorities" tab under Internet Option > Content > Certificates.

Can you check if you have any issues with the certificate when you navigate to https://www.cloudflare.com/ with either Internet Explorer or Edge?

[clamavuser]

I imported the certs to my machine and it now works. Just a temp solution until they expire/get renewed but it works. Thanks! From: Micah Snyder ***@***.***> Sent: Monday, December 20, 2021 8:15 PM To: Cisco-Talos/clamav ***@***.***> Cc: Wilson, Chad - US ***@***.***>; Author ***@***.***> Subject: Re: [Cisco-Talos/clamav] Freshclam on windows SSL peer certificate or SSH remote key not found (Issue #404) EXTERNAL EMAIL - This email originated from outside of CACI. Do not click any links or attachments unless you recognize and trust the sender. Freshclam.exe on Windows uses the system certificate store for the CA certificates to verify the TLS connection to Cloudflare, our CDN for serving the signature databases. Cloudflare's certs are signed by the Baltimore CyberTrust Root CA, which should appear in your "Rusted Root Certificate Authorities" tab under Internet Option > Content > Certificates. Can you check if you have any issues with the certificate when you navigate to https://www.cloudflare.com/ with either Internet Explorer or Edge? — Reply to this email directly, view it on GitHub<#404 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AW7ZFABQK6WKJHHY2DSW7SDUR7IKHANCNFSM5KOKEJXQ>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

…

________________________________ This electronic message contains information from CACI International Inc or subsidiary companies, which may be company sensitive, proprietary, privileged or otherwise protected from disclosure. The information is intended to be used solely by the recipient(s) named above. If you are not an intended recipient, be aware that any review, disclosure, copying, distribution or use of this transmission or its contents is prohibited. If you have received this transmission in error, please notify the sender immediately.

[micahsnyder]

That's great to hear!