Why is OCM v7 failing to download engine updates even if the OPSWAT update server is whitelisted?

Summary

When OPSWAT Central Management (OCM) v7 attempts to download engine updates from
https://update.dl.opswat.com, the connection may fail if the customer’s network uses an HTTPS inspection gateway (proxy, firewall, or secure web gateway) that re-signs TLS traffic with an internal certificate.

In this scenario, OCM does not trust the re-signed certificate unless the inspection gateway’s certificate chain is imported into the Java keystore used by OCM.

Symptoms

• OCM engine updates fail to download

• SSL/TLS or certificate validation errors in OCM logs

• When accessing https://update.dl.opswat.com in a browser from the same network, the displayed certificate:

  • Is issued by an internal corporate CA

  • Does not match OPSWAT’s public certificate chain

Cause

The customer’s network is using an SSL/TLS inspection gateway (also known as HTTPS inspection or TLS interception).
This device:

1. Terminates the TLS connection

2. Inspects the traffic

3. Re-encrypts it using an internal root/intermediate CA

Java (used by OCM) does not automatically trust internal or private CAs unless they are explicitly added to its keystore.

Resolution

Import the full certificate chain used to re-sign the traffic into the Java keystore used by OCM.

This includes:

• Root CA certificate

• Intermediate CA certificate(s)

• The server certificate presented for update.dl.opswat.com(If applicable)

After importing the certificates, restart the OCM service.

Step 1: Identify the Java Path Used by OCM

Check the OCM Java path by following the steps at https://www.opswat.com/docs/ocm/configuration/java-configuration

Step 2: Check Existing Certificates in the Java Keystore

1. From an elevated command line interface, navigate to the Java bin directory, for example:

   cd "C:\Program Files\OPSWAT\Central\jreXX\bin\"

2. Run the following command to list certificates:

   keytool -list -v -keystore "C:\Program Files\OPSWAT\Central\jreXX\lib\security\cacerts" -storepass changeit

   Alternative locations (depending on Java installation):

   keytool -list -v -keystore "C:\Program Files\Java\jdkXX\lib\security\cacerts" -storepass changeit
   keytool -list -v -keystore "C:\Program Files\Java\jreXX\lib\security\cacerts" -storepass changeit

3. Verify whether the following certificates are present and not expired:

   • The certificate presented for update.dl.opswat.com

   • Inspection gateway/proxy certificate

   • Intermediate CA certificate(s)

   • Root CA certificate

Step 3: Import the Required Certificates

If any certificates are missing, import them into the Java keystore.

Follow the official OPSWAT guide:
https://www.opswat.com/docs/ocm/configuration/adding-certificates-to-java-keystore

Repeat the import process for:

• Root CA

• Intermediate CA(s)

• Server certificate (if required by the gateway)

Step 4: Restart OCM Services

After importing the certificates:

1. Restart the OPSWAT Central Management service

2. Retry engine updates