I have an error when trying to rebuild my openvas database that appears to be caused by a certificate problem. I'm out of the usual debugging I'd so and I'm at a loss as to what is going on.

Here's the command I wanted to run.

server# openvasmd --rebuild --progress
Rebuilding NVT cache... failed.

Checking openvasmd.log I find the following, indicating I need to update my certificates.

lib  ... openvas_server_verify: the certificate is not trusted
lib  .... openvas_server_verify: the certificate hasn't got a known issuer

On double checking the commands I rebuild the server and user certificates with the following:

openvas-mkcert -q -f
openvas-mkcert-client -n -i

The server cert files it creates all show today's date and time. The four files that it creates all show today's date and time.

/var/lib/openvas/CA/cacert.pem /var/lib/openvas/private/CA/cakey.pem /var/lib/openvas/CA/servercert.pem /var/lib/openvas/private/CA/serverkey.pem

I restarted the manager daemon using strace to be sure that these certificates are right.

server# strace -f -e open openvasmd 2>&1 | grep pem
open("/var/lib/openvas/private/CA/serverkey.pem", O_RDONLY) = 4
open("/var/lib/openvas/CA/servercert.pem", O_RDONLY) = 4
open("/var/lib/openvas/CA/cacert.pem", O_RDONLY) = 4

I then checked that the server certificate is indeed valid:

server# openssl verify -CAfile /var/lib/openvas/CA/cacert.pem /var/lib/openvas/CA/servercert.pem
/var/lib/openvas/CA/servercert.pem: OK

By all rights this should be working. What is going on?


Execute this:

openssl verify -CAfile /var/lib/openvas/CA/cacert.pem /var/lib/openvas/CA/servercert.pem

openssl verify -CAfile /var/lib/openvas/CA/cacert.pem /var/lib/openvas/CA/cacert.pem

openssl verify -CAfile /var/lib/openvas/CA/cacert.pem /var/lib/openvas/CA/clientcert.pem

And the solution is:

openvasmd --modify-scanner $(openvasmd --get-scanners) --scanner-ca-pub /var/lib/openvas/CA/cacert.pem --scanner-key-pub /var/lib/openvas/CA/clientcert.pem --scanner-key-priv /var/lib/openvas/private/CA/clientkey.pem
  • Thanks, this solution worked for me. The EPEL RPM package paths are a bit different though. Certs are stored in /etc/pki/openvas/CA, keys in /etc/pki/openvas/private/CA. So the command that I used was: openvasmd --modify-scanner $(openvasmd --get-scanners) --scanner-ca-pub /etc/pki/openvas/CA/cacert.pem --scanner-key-pub /etc/pki/openvas/CA/clientcert.pem --scanner-key-priv /etc/pki/openvas/private/CA/clientkey.pem – Onnonymous Jun 29 '17 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.