How do I fix module update error “Error parsing metadescriptor, message='Could not download metadescriptor'”?

Cause

This error occurs when there is connection issue between MetaDefender Core and the update server, such as proxy server not configured correctly, update server unreachable, or SSL issues.

Solution: If MetaDefender Core is updating from the Internet

MetaDefender Core pulls engine updates from update.dl.opswat.com when Internet update is configured, to avoid issue:

1. Make sure that update.dl.opswat.com is reachable from the MetaDefender Core server.
2. If a proxy is used, please make sure it’s configured correctly in Proxy configuration.

When the above certificate error occurs for update.dl.opswat.com, you might find the following in core.log:

To remediate this issue, manually access https://update.dl.opswat.com from a browser, and download the certificate chain:

View “https://update.dl.opswat.com” certificate.

Export “https://update.dl.opswat.com” certificate.

Once the certificate chain is downloaded, export the root and intermediate certificates:

Export the root and intermediate certificates.

Then, manually import each certificate in the chain (including root and intermediate certificates) into the server’s trust store:

• Windows:

  1. Double-click the .crt file → opens "Certificate".
  2. Click "Install Certificate...".
  3. Choose "Local Machine" (You will need Administrator rights).
  4. Choose "Place all certificates in the following store"
  5. Click Browse → select Trusted Root Certification Authorities.
  6. Click Next, then Finish.

• Debian:

  1. Copy your certificate to the trusted directory: sudo cp mycert.crt /usr/local/share/ca-certificates/
  2. Update CA store:sudo update-ca-certificates

• RedHat Enterprise Linux:

  1. Copy the certificate: sudo cp mycert.crt /etc/pki/ca-trust/source/anchors/
  2. Update CA Trust: sudo update-ca-trust extract

After that, restart “OPSWAT MetaDefender Core” service, and the certificate for update.dl.opswat.com should be trusted.

Solution: If MetaDefender Core is managed by OPSWAT Central Management

MetaDefender Core is pulling module updates from OCM, to avoid SSL issue:

1. If OCM is using a certificate for HTTPS connection, make sure that the certificate subject’s common name matches the OCM server’s URL.
2. The OCM server’s certificate must also be trusted on the MetaDefender Core server by importing to the server’s trust store.
3. The OCM server’s address must be resolvable from the MetaDefender Core server.