How do I Resolve SSL Handshake Failures when Updating OPSWAT MDCore modules — Certificate Chain SSL Error for URL 'https://update.dl.opswat.com' ?

Summary:

When updating OPSWAT MDCore modules, SSL handshake failures related to certificate chain issues may occur while accessing the update server https://update.dl.opswat.com. This article explains the cause and how to permanently resolve the issue.

Problem:

During failed update attempts, you may see logs like:

The server (update.dl.opswat.com) uses SSL certificates issued by Amazon's Certificate Authority (CA), typically Amazon Root CA 1 and possibly intermediates like Amazon RSA 2048 M02.

Since our update server utilizes a Content Delivery Network (CDN), the certificate chain presented at your geographic location may differ slightly from the one seen at OPSWAT Support.

Example:

Because of this difference, your system might require trusting additional certificates such as the Starfield Services Root Certificate Authority - G2 to complete the SSL chain verification. This leads to consistent SSL handshake errors unless manually corrected.

Solution:

You must export the correct certificate chain from your environment and manually import the certificates into your local Trusted Root Certification Authorities store.

Step-by-Step Instructions

1. Access the Update Server in Your Browser

• Open a browser (e.g., Microsoft Edge or Chrome).
• Visit: https://update.dl.opswat.com

2. Export the Certificates

• Click on the security lock icon next to the address bar.

• View Certificate details.

• Export the first certificate (subject certificate):
  • Save it as _.opswat.com.crt.

• Open the exported certificate file.

3. Export the first certificate (subject certificate):

• In the certificate viewer, go to the Certification Path tab.

• Select the second certificate (the intermediate CA), then click View Certificate.
• Go to Details → Copy to File.

• Select Base-64 encoded X.509 (.CER) format.
• Save it as Intermediate.crt.

• Repeat the same process for the root certificate:
  • Save it as Root.crt.

You should now have three certificate files:

• _.opswat.com.crt (subject/leaf)
• Intermediate.crt (intermediate CA)
• Root.crt (root CA)

4. Import Certificates into Trusted Root Certification Authorities

For each of the three certificates:

1. Double-click the .crt file to open it.
2. In the General tab, click Install Certificate.
3. Choose Local Machine → Next.

4. Select Place all certificates in the following store → Browse → Trusted Root Certification Authorities.

5. Click Next, then Finish.

5. Restart OPSWAT MetaDefender Core Service

After importing the certificates, restart the OPSWAT MDCore service.

Additional Notes:

• Certificates must be trusted system-wide for all OPSWAT services to function correctly.
• You only need to perform this process once unless there are major future changes to the certificate authorities.
• Always export the certificate chain from your own environment to match what your CDN edge location provides.