Hi all,

I have Kaspersky Internet Security on Windows 10 with Thunderbird as email client using POP3 for downloading emails. Since August 28, Thunderbird stopped downloading new emails and after some research, I found that Kaspersky apparently installs its own certificate for the POP3 server and this certificate has expired on August 28. Hence Thunderbird refuses to connect to the POP3 server.

Thus the reason for the problem is very simple and clear: Kaspersky's certificate has expired.

Thus my question is very simple: How do I make/trigger Kaspersky to renew this local certificate?

There are lots of similar questions in the forum and the answers usually are to exclude the particular POP3 server from Kaspersky. This is in my opinion not a feasible solution because - in my understanding - this stops Kaspersky from scanning emails. Please tell me if my understanding is incorrect. But anyway, I think everybody agrees that the proper solution to a expired certificate is to renew this particular certificate, hence my question on how to renew this certificate.

Thanks a lot for any help :-)

Pete

Edited September 3Sep 3 by Pete.M
Typing error on the dates.

Welcome to Kaspersky Community.

Please, provide version of K. product installed.

If You are still using KIS, please migrate to Kaspersky Standard:

KIS/KAV/KTS are obsolete products...

Oh, sorry, my fault, reading incorrectly from my own notes: Sure I'm using Kaspersky Standard with all updates, license valid until June 2027.

What version? 21.26?

Run certmgr.msc in Your Windows, and go to Trusted Root Certification Authorities, and find Kaspersky cert there:

If Your K. Standard it's up to date, I doubt Your K. certificate got expired 🤔

@Pete.M, look at this article - https://support.kaspersky.com/kaspersky-for-windows/21.26/settings/14620#block2

Still I think ThunderBird can use K. cert directly from Windows cert store 🤔

It depends on your antivirus settings. By default, Thunderbird uses the Mozilla certificate store.

Certificate store

I am on Windows certificate 🤔

3 hours ago, harlan4096 said:

What version? 21.26?

Run certmgr.msc in Your Windows, and go to Trusted Root Certification Authorities, and find Kaspersky cert there:

If Your K. Standard it's up to date, I doubt Your K. certificate got expired 🤔

Hello again

The version of Kaspersky Standard is 21.23.6.614(a), German language. I see no way to force any update to 21.26 or whatsoever. If there is a way to force an update to the latest version (21.26?), please let me know. It is my understanding that Kaspersky updates itself and the user does not have to care, right?

As far as the certificate is concerned, I'm not talking about the root certificate. Of course, the root certificate has not expired. I'm talking about the certificate that Kaspersky used to 'fake' the POP3 server in order to scan the traffic between Thunderbird and the real POP3 server. Thunderbird complains that this certificate has expired and when I have Thunderbird display the contents, the following shows up:

Sorry for German. As you can see, the certificate is issued by AO Kaspersky Lab and 'simulates' the real POP3 SSL/TLS server certificate with server name 'pop3s.bluewin.ch'. It's this certificate that has expired on August 28 which makes Thunderbird to not trust this (faked) server any more. I've temporarily added an exception within Thunderbird and disabled email checking in Kaspersky to make Thunderbird happy again, but this is not a solution. I need a way to have this particular certificate renewed.

This certificate is not stored in the MS certificate store; it is used within Kaspersky to simulate/emulate/fake the real POP3 server.

Hope this helps and clarifies my question.

Hallo @Pete.M, please read:

How to add a Kaspersky root certificate

You can view the page in another language

Maybe that helps.

MfG Tschekker

Windows11 Pro, Version 25H2

Kaspersky Premium: 21.26.4.406

Kaspersky Passwort Manager: 26.0.0.748

Kaspersky VPN: 21.26.4.406-2

Edited September 4Sep 4 by Tschekker
edit

32 minutes ago, Tschekker said:

Hallo @Pete.M, please read:

How to add a Kaspersky root certificate

You can view the page in another language

Maybe that helps.

MfG Tschekker

Windows11 Pro, Version 25H2

Kaspersky Premium: 21.26.4.406

Kaspersky Passwort Manager: 26.0.0.748

Kaspersky VPN: 21.26.4.406-2

Dear Tschekker

Thanks for your comment. But I'm NOT talking about the root certificate, I'm talking about the server certificate that Kaspersky generates to make Thunderbird believe it talks to the 'real' POP3 server.

The root certificate in my installation is perfectly good, but the server certificate - issued by 'AO Kaspersky Lab' - expired on August 28 (see my screenshot above) and needs to be renewed. Copying/installing a root certificate will not help in this situation.

Thanks for any help/advise.

48 минут назад, Pete.M сказал:

The root certificate in my installation is perfectly good

21.23???? That is an old version, just download new 21.26 installer and overwrite the current 21.23.

Also, is that email account managed by GMail? Because Google is stopping POP3 support:

https://support.google.com/mail/answer/16604719?hl=en

2 hours ago, andrew75 said:

Hi andrew75

Not sure what you want to tell me. What you are underlining in my screenshot is the root certificate of the issuing party, which - as I said - is perfectly OK. But this is NOT the certificate that is shown in my screenshot. The root certificate is in the Microsoft cert store and is still valid until 18-Nov-35.

1 hour ago, harlan4096 said:

21.23???? That is an old version, just download new 21.26 installer and overwrite the current 21.23.

Thanks for this hint; I'll try this, but I'm a bit puzzled why Kaspersky does not update itself to the newest version. I installed Kaspersky Standard about a year ago and I wonder if this means that I have to regularly check and re-install Kaspersky software in order to be on the latest version/level?

1 hour ago, harlan4096 said:

Also, is that email account managed by GMail? Because Google is stopping POP3 support:

https://support.google.com/mail/answer/16604719?hl=en

Nope, not Google, not Gmail, regular mail provider that still supports POP3.

11 минут назад, Pete.M сказал:

But this is NOT the certificate that is shown in my screenshot

This is the certificate from your screenshot.

Thunderbird uses the Mozilla certificate store, not the Microsoft store.

The article you were linked to describes how to add a certificate from the Microsoft store to the Mozilla store.

It is also recommended to make the following setting in Kaspersky settings:

It's weird You did not get the recent versions via auto-update, but I know it's working for the recent 21.24-25-26 🤔but it is true that they are delivered gradually...

2 hours ago, andrew75 said:

This is the certificate from your screenshot.

Thunderbird uses the Mozilla certificate store, not the Microsoft store.

The article you were linked to describes how to add a certificate from the Microsoft store to the Mozilla store.

It is also recommended to make the following setting in Kaspersky settings:

Dear andrew75

I think we are turning in circles - sorry if I am the source of the confusion. There are always (at least) TWO certificates involved. Once is the root certificate and the other is some sort of a server or client certificate.

In this particular case, the root certificate is definitively OK with an expiration date far in the future, thus there is no problem with the root certificate.

The other certificate in this particular case is a server certificate generated by Kaspersky Standard to simulate a POP3 server. This certificate expired on August 28, and subsequently Thunderbird refused to download new emails because it refused to accept an expired certificate. Kaspersky Standard should have renewed it before it expired. This apparently did not happen and caused the problem I have.

The confusion probably arises from the fact that the (expired) server certificate mentions the root certificate in its information about the issuer, which is completely conformant with and even required by X.509v3 certificate standard.

So let me explain again: It is the server certificate (not the root certificate), shown in my screenshot above, that was not renewed on time and that causes my current problem with Thunderbird. Thunderbird behaves totally correctly as it does not accept an expired certificate. Thus my question still is: How can I make Kaspersky Standard to renew this server certificate?

I will try to re-install the newest version and then we will see if that helps. (Give me some time as I cannot take a re-install very easy.) I'll post the outcome here, of course.

24 минуты назад, Pete.M сказал:

I think we are turning in circles

I think so too.

24 минуты назад, Pete.M сказал:

How can I make Kaspersky Standard to renew this server certificate?

All the answers you need are given to you in this thread.
To avoid translation errors, I don't want to explain in detail in a language that's not my native language how encrypted connections scan works in Kaspersky Anti-Virus. And the specifics of its operation in Thunderbird.
Therefore, I recommend that you contact technical support.

Sorry, I did not mean to hurt anybody. Please take my apology if this is the case.

While it's totally true that I do not understand the internals of Kaspersky, I am pretty familiar with encryption protocols like HTTPS or POP3S and associated industry standards, best practices and certificate handling. I'm sure Kaspersky follows such practices, just like any other antivirus product or any other scanners that need to 'break' an encrypted channel.

The problem I see is very clear and understandable, and Thunderbird behaves exactly the way it should, following industry standards. And it happened exactly on August 28 when Kaspersky's (fake) server certificate expired.

Like a doctor, I'd like to have a clear diagnosis, an explanation for the things happened, and then a clear solution to the problem. I don't like to 'try this, try that', and the like. The windows PC having this issues is not my personal PC; it belongs to an elderly person who I am supporting, living about 50 km away, so it is not easy for me to 'try this, try that'. Kaspersky has been running on this PC since 2015 without any issues ... until August 28 this year when said certificate expired.

The only clear diagnosis we have so far is that the Kaspersky installation is not at the latest level, for whatever reason. I will take care of this and then we see from there whether or not that solves the problem or whether I have to go to technical support.

Thanks anyway for all your input here, I appreciate it!

Hi all,

As promised, I'd like to provide feedback after installing the latest version 21.26:

The long story short: SUCCESS!

The installation of the latest version over the previous install caused Kaspersky Standard to re-create the (fake) POP3 server certificate in question, which made Thunderbird (and myself :-) ) happy, problem solved. Here's the new server certificate:

As can be seen above in the oval, the new expiration is 05-Mar-27, thus Thunderbird accepts it as a valid certificate (together with the corresponding root certificate, of course).

The only remaining concern is: Why did auto-update not work and how can I detect this in the future? There was no pop-up or any other "red flag" presented to the user indicating that Kaspersky was unable to update itself; it just silently stopped updating. Deep in the messages there was a mentioning that the PC needs to be rebooted to complete an update, but there was no date and no mentioning of any version numbers, so I have no idea for how long this condition existed. The PC was rebooted several times, but apparently with no luck, thus the update had to be done manually via installation over the current installation as per your suggestion further up in this discussion.

Also, it is not really easy to find out what the latest version actually is, so the owner of the PC (a 70+ year old lady) has basically no way to find out if the problem re-appears. She can only wait and see if email continues to work after 05-Mar-27, when the current certificate expires.

Anyway, thanks for your help here :-)

Pete

Glad finally solved, so my suggestion was the right way...

Currently Kaspersky is releasing a new version every 3 months aprox.

15 hours ago, harlan4096 said:

Glad finally solved, so my suggestion was the right way...

Currently Kaspersky is releasing a new version every 3 months aprox.

Exactly. And it was an important piece of information that I can install a new version over the existing version. Not sure if I had done this, anxious to loose any config and/or license information with a 'new' installation.

Installation (over writing) over the previous version, usually keeps most of the custom config and also the license subscription.

How to update the application:

https://support.kaspersky.com/kaspersky-for-windows/21.26/71677?page=help

16 часов назад, Pete.M сказал:

Why did auto-update not work and how can I detect this in the future?

Perhaps there were some issues with auto‑update. It should work even for updates with skipping one or more versions (e.g., from 21.23 to 21.26). The app is usually updated without an OS restart, but in the case of problems it may be required.