Elements Agent cannot download updates from Withsecure update server with error=71 (protocol error)

Issue:

Elements Agent shows "protection malfunction" status in the local user interface due to it being unable to download updates from the WithSecure update server.

AUA.log shows:

I: Update check failed, error=71 (protocol error)

Resolution:

If the Elements Agent device is unable to download malware definition or engine updates and error=71 is shown in the AUA.log file, first run the WithSecure Connection Checker tool to make sure that the connectivity towards the update servers is OK. The tool can be found in the Elements Agent installation folder: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

If the connectivity is OK towards the update servers, try to run the FSAUA-reset tool and restart the computer to see if that fixes the issue: https://support.withsecure.com/en/support/support-tools

If the device is a server, check if you can see similar errors in the logs:

• *I: [fslib] downloading updates list 'https://guts2.sp.f-secure.com/u;t=deepguard-db;hydra-win64;lynx-win64;oneclient-psb-win32;sccore-win64;ulcore-win64;ulupdater-win64;uss-win64;virgo-win64'
• *E: [fslib] WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR
  2023-01-31 09:29:31.744 [06bc.1b38] *E: [fslib] Error occurred during WinHttpSendRequest, error 12175, flags 0x80000000
• *W: [fslib] Got ERROR_WINHTTP_SECURE_FAILURE with only WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR in flags, retrying
• *E: [fslib] WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR

Usually this issue is caused by non-default or misconfigured Windows SSL/TLS settings in the Windows registry.

Follow this troubleshooting guide:

1. Download IIS Crypto GUI and run this tool https://www.nartac.com/Products/IISCrypto/Download
2. Navigate to Advanced tab and press Backup button to backup SSL/TLS settings as .reg-file. It can be used to compare the settings with working systems or for restoring the original settings.
3. Navigate to Templates tab, select "Server Defaults" item from the dropdown list and click Apply button. The tool will write the default Windows SSL/TLS settings to the registry.
4. Alternatively, "Best practices" or "Strict" templates could be used as well if you would like to use more strict SSL/TLS settings than default. We support those templates as well.
5. Reboot the system