IWSVA still gets the old certificates because “Spoofed” certificates generated by iwssd are stored in the var/iwss/https/certstore/certificates memory cache.
Before iwssd generates a new “Spoofed” certificate to spoof the identity of the destination server to the client, it checks the “Spoofed” certificate cache. If it exists, the certificate in the cache is used to establish SSL connection to client.
To resolve the issue, clear the cached certificates:
- Log in as root on CLI.
- Stop HTTP scanning daemon using the command:
/var/iwss/S99ISproxy stop
- Navigate to the /var/iwss/https/certstore/certificates folder.
- Remove all the PEM files using the command:
rm -f *.pem
- Start HTTP scanning daemon using the command:
/var/iwss/S99ISproxy start