Could this be causing my SSL scan problem?

[jadinolf]

I don't know what your ISP or what your email client are, but mine, BT Internet, has Yahoo handle my email, but I don't have yahoo in my email client account settings, I enter my ISP email server details mail.btinternet.com and usual ports and that is somehow handed off to yahoo.

But I don't see that as it happens in the background, only when I use webmail do I then see the BT Yahoo branding.

So there is certainly something weird going on with your ISP and email server settings, never seen anything like this before though. I would start from scratch and visit your ISP site and confirm that your email settings are correct.

But if those two entries are still in the avast SSL settings I would remove them, you didn't say if you had done that or not.

David, you are talking to one of the unluckiest guys in the world. I had to pick this ISP. Bear in mind, I only have one other choice and they both use the same phone lines.

Trust me, my email info is correct. I can set it up blindfolded.

Also avast! plays a major role  in this scenario IMHO.

Anyway, no one knows that my ISP uses gmail. Like you, the REAL address XXXXXXX@dslextreme.com  That's all my correspondents see. It goes thru gmail.

I am not going to worry about the things in the SSL setting. That computer works. If I ever have to do  clean install of avast!, the information will disappear.

A little information- everyone I know who has my ISP and avast! has the same problem. These are people I got started on avast!. Now they hate me, of course. My people all switched to MSE.

[Pondus]

in my opinion the worst mail you can use is ISP mail....
not because it is something wrong with it, but if you switch ISP you usually also need to get a new mail adress   
so if you use somthing like Gmail / Yahoo / Outlook / Fastmail .... you have the same mail whatever ISP you use   

[jadinolf]

in my opinion the worst mail you can use is ISP mail....
not because it is something wrong with it, but if you switch ISP you usually also need to get a new mail adress   
so if you use somthing like Gmail / Yahoo / Outlook / Fastmail .... you have the same mail whatever ISP you use   

Pondus, I agree with you 100%.

My ISP email address book contains only 14 addresses- mostly blood relatives.

I have hundreds of addresses in my gmail address book. Emails to my gmail address then go to my ISP mail. I like that. If I need to reply to the gmail addresses, I go to gmail and reply there.

Point of interest, virtually no one knows what I call my real email address is. I like that. Of course if you would like it, I'll tell you.

[lukor]

Hi Jadinolf,


First, this existence of the said account entries (your two pictures at the begining of this thread) is not important. They are left there from previous installations.


Previously, avast required you to disable SSL inside your mail client - to be able to see into the connection. The accounts listed here (in the screenshots) were used to know which connections should be upgraded to SSL. This is no longer necessary as MailShield decrypts the connections on the fly and re-ecrypts it with its own certificate.


However, there are other possible problems - especially if you are the unluckiest guy in the world. Such as that your mail client might have refused the certificate from avast, doesn't use standard windows certificate store, does not have the option to manualy add or edit trusted certificates, etc.


Can you please sum up a few things for the troubleshooting:


- what is the name of your mail client and where can we download it for testing
- what are you SMTP and POP settings  - you can leave your login credentials out :-)
- do you see any error messages during mail download/send attempts? Can you post a screenshot of those?


With this we can test it here and try to come up with some guide to solve it. It would most probably involve manually importing avast certificates into the client.


Thanks a lot.
Lukas.

[jadinolf]

Good day to you lukas. I have been looking forward to having someone from the avast! team to drop in.

My mail program is Postbox 3.08
https://www.google.com/search?source=ig&rlz=&q=download+postbox&oq=download+postbox&gs_l=igoogle.1.0.0l7j0i22i30l3.354.6527.0.9365.15.11.0.4.4.0.273.1597.0j10j1.11.0...0.0...1ac.1.12.igoogle.JxlLOb9w-Zc

It is very similar to Thunderbird.

My friends have the same SSL problems with Thunderbird as I have with Postbox. They also have the same ISP as me (dslextreme.com).

Mail settings are as follows:

pop.gmail.com
smtp.gmail.com

I will show 4 screenshots.

I have more.

Many thanks, lukor

[vojtech]

Postbox mail client is based on Mozilla so you need to follow this guide (like Thunderbird):
http://www.avast.com/FAQ/AVKB91#artTitle

[ComputerRepairTech]

This is no longer necessary as MailShield decrypts the connections on the fly and re-ecrypts it with its own certificate.

Ahh well that explains that.

[jadinolf]

Postbox mail client is based on Mozilla so you need to follow this guide (like Thunderbird):
http://www.avast.com/FAQ/AVKB91#artTitle

Thunderbird is based on Postbox and it will be better to do what I have done- uninstall AIS and change antivirus programs. The alternative is to use web mail.

I was hoping avast! would fix it. I guess not. Remember, there are many people having this problem.

[lukor]

Hi Jadinolf,


is there anything offensive on the guide offered by Vojtech? I guess it would also be solved if you would click the "Confirm Security Exception" button.


The thing is, if we want to inspect the SSL encrypted traffic, we need to decrypt it and re-encrypt it back. During this process the certificate is re-signed by our "avast! Mail Scanner Root" certificate. All the process described in the link provided by Vojtech describes the steps needed to make your mail client trust this certificate again. It needs to be done only once and only in cases your mail client doesn't use Windows native certificates (such as Thunderbird/Postbox).


Anyway, you can also uncheck SSL Mail scanning in the Mail configuration pages if you are better without that.


We are thinking about possible ways how to improve the experience in these cases.


Lukas.

[jadinolf]

Hi Jadinolf,


is there anything offensive on the guide offered by Vojtech? I guess it would also be solved if you would click the "Confirm Security Exception" button.


The thing is, if we want to inspect the SSL encrypted traffic, we need to decrypt it and re-encrypt it back. During this process the certificate is re-signed by our "avast! Mail Scanner Root" certificate. All the process described in the link provided by Vojtech describes the steps needed to make your mail client trust this certificate again. It needs to be done only once and only in cases your mail client doesn't use Windows native certificates (such as Thunderbird/Postbox).


Anyway, you can also uncheck SSL Mail scanning in the Mail configuration pages if you are better without that.


We are thinking about possible ways how to improve the experience in these cases.


Lukas.

We are thinking about possible ways how to improve the experience in these cases.
Lukas, nothing offensive but I am just a 79 year old grandfather who has used avast! since 2007 and never had a mess like this, Now in order to use avast!, I have to go in and play computer expert which I am not. Plus I have the people whom I have convinced to use avast! screaming at me to fix the problem.

I have removed avast! from 3 computers. The license expires in late June anyway.

On the other license for 3 computers, 2 computers seem fine although all experienced error messages related to the certificate thing. On the third computer, I have unchecked scan SSL .

[jadinolf]

I think I should mention that this certificate problem started approximately April 27, 2013 with the message that there were two certificates out there with the same serial number. This, of course, meant nothing to me because I had never seen anything like that in my experience.

Well, it just got worse and worse after that with messages popping up all over the place.

[lukor]

Jadinolf, I am so sorry for the problems you are experiencing, believe me. The problem we are solving here - scanning a SSL connection that is actually protected against the fact that anyone looks into it - is a technically complex problem. This is why when anything goes wrong, the solutions are also technically somewhat complex.


Turning off the SSL scanning feature is probably the best way how to quickly solve this for you, and the program should most probably do it for you once any problems are detected. This is what it now needs to be fixed in the next update.


I'll ask Vojtech about the "same serial number" certificates. Perhaps he can shed some light on what has really happened at your (and seemingly other's) places.


Lukas.

[jadinolf]

Jadinolf, I am so sorry for the problems you are experiencing, believe me. The problem we are solving here - scanning a SSL connection that is actually protected against the fact that anyone looks into it - is a technically complex problem. This is why when anything goes wrong, the solutions are also technically somewhat complex.


Turning off the SSL scanning feature is probably the best way how to quickly solve this for you, and the program should most probably do it for you once any problems are detected. This is what it now needs to be fixed in the next update.


I'll ask Vojtech about the "same serial number" certificates. Perhaps he can shed some light on what has really happened at your (and seemingly other's) places.


Lukas.

Thank you very much. Nice to see avast!, Inc stepping in to help.