Avast WEBforum
Consumer Products => Avast Mac Security => Topic started by: Fenikkusu on March 01, 2013, 03:39:36 AM
-
I'm up-to-date. However, I'm still unable to connect to my email with the MailShield enabled. I'm running 3 accounts in Thunderbird. 2 non-standard and 1 GMail account. Prior to the SSL updates, my 2 non-standards worked but my Gmail did not. My error logs show the following line:
com.avast.proxy[6532]: SSL_accept(): sslv3 alert bad certificate
It should be noted that the 2 non-standard while both valid certificates, do not map to the domain for which they are actually registered (Nothing I can do about this).
-
i just had the same problem, try disabling the ipv6 support in avast preferences, worked for me. i also had to disable it in the web shield as it made my internet connection unbearably slow.
-
Same thing here ~6-7 email accounts spread all over comcast, gmail, host company, work account via exchange and as soon as I turned on mail shield all of them couldnt connect. I unchecked IPv6 and so far its working (all accounts connecting and seeing # of items scanned for mail), thanks for the tip.
EDIT - didnt have to disable IPv6 anywhere but the mail shield settings for it to work for me.
-
Disabling IPv6 has no affect.
-
In your case you'll have to add the avast! untrusted certificate to thunberbird's certs.
This happens because even thou the self-signed certs are in the corresponding keychain (or the equivalent in thunderbird) and marked as trusted avast! doesn't resign using the avast! Trusted Cert and uses the Untrusted. I tried to bring attention to this issue during the Beta but it was ignored, so hey, I did my part *shrug*.
-
This happens because even thou the self-signed certs are in the corresponding keychain (or the equivalent in thunderbird) and marked as trusted avast! doesn't resign using the avast! Trusted Cert and uses the Untrusted. I tried to bring attention to this issue during the Beta but it was ignored, so hey, I did my part *shrug*.
If the (self signed) certificate is in one of the "System" or "System Roots" keychains, where the proxy takes its own certificates from, then it works fine = the certificate is resigned with the "avast! trusted CA" certificate. So to connect to a server that is using a self signed certificate with mail shield enabled (and SSL scanning turned on), you have to import the servers certificate to the "System" keychain.
-
This happens because even thou the self-signed certs are in the corresponding keychain (or the equivalent in thunderbird) and marked as trusted avast! doesn't resign using the avast! Trusted Cert and uses the Untrusted. I tried to bring attention to this issue during the Beta but it was ignored, so hey, I did my part *shrug*.
If the (self signed) certificate is in one of the "System" or "System Roots" keychains, where the proxy takes its own certificates from, then it works fine = the certificate is resigned with the "avast! trusted CA" certificate. So to connect to a server that is using a self signed certificate with mail shield enabled (and SSL scanning turned on), you have to import the servers certificate to the "System" keychain.
That's exactly my case but avast keeps signing it with avast! untrusted, I suspect the nuance here is the fact that like the thread starter, my self-signed cert does not map to the domain it's registered to (it redirects, it's basically a virtual server with multiple mail domains and the certs all map to the server's domain and not the virtual domains).
This setup works without mailshield enabled because I imported the self-signed cert into the system keychain, but with mailshield on it asks me to trust avast! untrusted.
-
At least you could say you can't reproduce it, but THERE IS a problem with self-signed certs.
-
IPv6 unchecked worked for a day now back to issues with it. Any chance of a real fix from Avast without having to deal with untrusted/trusted certs being discussed above? Or provide step by step instructions to manage the certs for Avast to play nice with my mail accounts?
-
That's exactly my case but avast keeps signing it with avast! untrusted, I suspect the nuance here is the fact that like the thread starter, my self-signed cert does not map to the domain it's registered to (it redirects, it's basically a virtual server with multiple mail domains and the certs all map to the server's domain and not the virtual domains).
This setup works without mailshield enabled because I imported the self-signed cert into the system keychain, but with mailshield on it asks me to trust avast! untrusted.
The invalid common name (CN) can not be an issue for the proxy - it does not check the CN, this is done by the mail client (the proxy does not know the demanded domain). So if the certificate chain is OK, then the server certificate will be resigned with the "trusted CA" regardless of the CN value. It is than the mail client's job to decide, whether the CN matches or not.
I assume your problem is in fact caused by a missing root certificate. That means your mail server in fact does not send an self-signed certificate, but a certificate signed by a "self generated" CA. In this case, you have to import the "self generated" CA's certificate to the system keychain, not the server certificate itself.
I can check this, if you give me the mail server address and the server is accessible on the internet (no login needed).
-
That makes sense tumic, that's probably it!
I'll send you the info via PM.
-
That makes sense tumic, that's probably it!
I'll send you the info via PM.
Unfortunately, the server you have send me using the PM, has really a self-signed certificate, so this is not the case. However, when I add its certificate to the 'System' keychain (and restart the proxy - this is required for the proxy to re-read the certificates), it works fine for me, i get it resigned using the 'trusted CA' when connecting with mailshield enabled.
-
I am using thunderbird (current version) and Mountain Lion (current version), Avast (current version). I have a pop account using SSL/TLS and 3 gmail accounts using IMAP, no mail comes in until I disable MailShield, I don't get any errors just no mail. Once I disable MailShield I get all my mail, this has only been an issue since the last Avast update. I see comments about the certs, is there a link to a step by step of how to fix this? Thanks in advance for any assistance.
-
I am using thunderbird (current version) and Mountain Lion (current version), Avast (current version). I have a pop account using SSL/TLS and 3 gmail accounts using IMAP, no mail comes in until I disable MailShield, I don't get any errors just no mail. Once I disable MailShield I get all my mail, this has only been an issue since the last Avast update. I see comments about the certs, is there a link to a step by step of how to fix this? Thanks in advance for any assistance.
- Chceck if you have the "avast! trusted CA" certificate installed in Thunderbird and that it matches the certificate in the "System Roots" keychain. If it is missing or not matching, export the certificate from the keychain and import it into Thunderbird
- Look into the system log file (/var/log/system.log) for com.avast.proxy messages, they will give you most likely the info what's going on.
-
tumic,
Avast build 38501 just downloaded, I turned mailshield back on (without messing with the certs) and my mail seems to be coming in just fine now using SSL on pop3 and gmail (IMap). This build seems to have fixed the problem on OSX 10.8.2
-
I am using thunderbird (current version) and Mountain Lion (current version), Avast (current version). I have a pop account using SSL/TLS and 3 gmail accounts using IMAP, no mail comes in until I disable MailShield, I don't get any errors just no mail. Once I disable MailShield I get all my mail, this has only been an issue since the last Avast update. I see comments about the certs, is there a link to a step by step of how to fix this? Thanks in advance for any assistance.
- Chceck if you have the "avast! trusted CA" certificate installed in Thunderbird and that it matches the certificate in the "System Roots" keychain. If it is missing or not matching, export the certificate from the keychain and import it into Thunderbird
- Look into the system log file (/var/log/system.log) for com.avast.proxy messages, they will give you most likely the info what's going on.
In my root certificates I have 1 that says "avast! trusted CA" in Thunderbird I have 2, how do I delete all but the one I need?
(http://i248.photobucket.com/albums/gg199/joelw135/ScreenShot2013-03-15at65948PM_zps1498b9a0.png)
-
That screenshot doesn't look anything like the current builds GUI of Thunderbird for mac.
-
Thx for the confirmation.
Mity
-
Thx for the confirmation.
Mity
It is Thunderbird 20, so I downgraded to version 17. I am testing now.