Plesk Premium Antivirus does not start after upgrading Ubuntu 20.04 to 22.04 on a Plesk server: Plesk authorization failed: HTTP request error [35]

Symptoms

• Plesk Premium Antivirus (Dr.Web) stopped working after the server operating system was upgraded from Ubuntu 20.04 to Ubuntu 22.04. The drwebd service constantly restarts and exits with code 255.

• The following messages are logged in the system journal for the drwebd service:

  CONFIG_TEXT: Key file: /opt/drweb/drweb32.key - Key file was not found! (No such file or directory)
  A path to a valid license key file was not specified.
  Plesk authorization failed: HTTP request error [35]
  Error: Plesk Software not running.
  systemd[1]: drwebd.service: Main process exited, code=exited, status=255/EXCEPTION

• Plesk Premium Antivirus does not listen on port 127.0.0.1:3000.

• The file /etc/sw-cp-server/conf.d/plesk-drweb-local.conf exists and its ssl_ciphers directive ends with @SECLEVEL=1:

  # grep -o '@SECLEVEL=[0-9]' /etc/sw-cp-server/conf.d/plesk-drweb-local.conf
  @SECLEVEL=1

• A TLS 1.0 connection to the local Plesk port is rejected, while TLS 1.2 works:

  # openssl s_client -connect 127.0.0.1:8443 -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null

   

  CONFIG_TEXT: error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:../ssl/record/rec_layer_s3.c:1593:SSL alert number 80

Cause

Plesk Premium Antivirus authorizes in Plesk over TLS 1.0 through a local listener defined in /etc/sw-cp-server/conf.d/plesk-drweb-local.conf. After the upgrade to Ubuntu 22.04, the Plesk web server uses OpenSSL 3, in which the @SECLEVEL=1 value left in this file from the previous operating system disables TLS 1.0, so the connection is rejected.

Resolution

1. Connect to the server via SSH.

2. Compare the configuration file with its current template:

   # diff /etc/drweb/swcpserver.plesk-drweb-local.conf.tpl /etc/sw-cp-server/conf.d/plesk-drweb-local.conf

   The only expected difference is @SECLEVEL=0 in the template and @SECLEVEL=1 in the configuration file.

3. Create a backup copy of the file:

   # cp -a /etc/sw-cp-server/conf.d/plesk-drweb-local.conf /etc/sw-cp-server/conf.d/plesk-drweb-local.conf.bak

4. Replace the file with the current template:

   # cp /etc/drweb/swcpserver.plesk-drweb-local.conf.tpl /etc/sw-cp-server/conf.d/plesk-drweb-local.conf

   Note: If the output of step 2 shows other differences, do not replace the file. Instead, edit the file /etc/sw-cp-server/conf.d/plesk-drweb-local.conf and change only @SECLEVEL=1 to @SECLEVEL=0

5. Warning: The following steps will cause a brief service interruption. The Plesk interface is unavailable for a few seconds. Mail services and websites are not restarted.

   Check the configuration syntax and restart the Plesk web server:

   # /usr/sbin/sw-cp-serverd -t && systemctl restart sw-cp-server

6. Make sure that the local port now accepts TLS 1.0:

   # openssl s_client -connect 127.0.0.1:8443 -tls1 -cipher 'AES128-SHA:@SECLEVEL=0' </dev/null 2>&1 | grep -E 'Protocol|Cipher'

7. Start Plesk Premium Antivirus and verify that it is running and listening on port 3000:

   # systemctl restart drwebd
   # systemctl status drwebd
   # ss -tlnp | grep 3000

8. If the Plesk web server fails to start after the change, restore the backup copy and restart the service:

   # mv /etc/sw-cp-server/conf.d/plesk-drweb-local.conf.bak /etc/sw-cp-server/conf.d/plesk-drweb-local.conf
   # systemctl restart sw-cp-server