打开 VAS - 服务暂时关闭（证书已过期）
Open VAS - Service temporarily down (Certificates expired)
所以我的证书在我的 Open VAS 安装上过期了。
因此，我在尝试 运行 扫描时遇到以下错误。
操作：启动任务
状态码：503
状态消息：服务暂时中断
我已经尝试重新创建证书：
me@ovas:~$ sudo /usr/sbin/openvas-mkcert -q -f
[sudo] password for me:
me@ovas:~$ sudo /usr/bin/openvas-mkcert-client -n -i
Generating RSA private key, 4096 bit long modulus
........................++
..................................................................................++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) []:Email Address []:Using configuration from /tmp/openvas-mkcert-client.28853/stdC.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'DE'
localityName :ASN.1 12:'Berlin'
commonName :ASN.1 12:'om'
Certificate is to be certified until Dec 5 12:38:09 2017 GMT (365 days)
Write out database with 1 new entries
Data Base Updated
me@ovas:~$
然后重启...
然后 Web 界面的一台已正确关闭，但扫描仪一台似乎不是？
这是在日志中：
lib serv:WARNING:2016-12-05 12h41.23 UTC:1533：无法与对等方握手：TLS 连接未正确终止。
事件 task:MESSAGE:2016-12-05 12h41.23 UTC:1533：target.me (3aca3163-3de2-4519-92af-f649f6bedd7c) 的任务扫描无法由 admin
启动
检查打开 VAS 脚本输出：
openvas-check-setup 2.3.7
Test completeness and readiness of OpenVAS-8
(add '--v6' or '--v7' or '--v9'
if you want to check for another OpenVAS version)
Please report us any non-detected problems and
help us to improve this check routine:
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss
Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.
Use the parameter --server to skip checks for client tools
like GSD and OpenVAS-CLI.
Step 1: Checking OpenVAS Scanner ...
OK: OpenVAS Scanner is present in version 5.0.7.
OK: OpenVAS Scanner CA Certificate is present as /var/lib/openvas/CA/cacert.pem.
OK: redis-server is present in version v=3.0.6.
OK: scanner (kb_location setting) is configured properly using the redis-server socket: /var/run/redis/redis.sock
OK: redis-server is running and listening on socket: /var/run/redis/redis.sock.
OK: redis-server configuration is OK and redis-server is running.
OK: NVT collection in /var/lib/openvas/plugins contains 50525 NVTs.
WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner.
SUGGEST: Enable signature checking (see http://www.openvas.org/trusted-nvts.html).
OK: The NVT cache in /var/cache/openvas contains 50548 files for 50525 NVTs.
Step 2: Checking OpenVAS Manager ...
OK: OpenVAS Manager is present in version 6.0.9.
OK: OpenVAS Manager client certificate is present as /var/lib/openvas/CA/clientcert.pem.
OK: OpenVAS Manager database found in /var/lib/openvas/mgr/tasks.db.
OK: Access rights for the OpenVAS Manager database are correct.
OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled.
OK: OpenVAS Manager database is at revision 146.
OK: OpenVAS Manager expects database at revision 146.
OK: Database schema is up to date.
OK: OpenVAS Manager database contains information about 49328 NVTs.
OK: At least one user exists.
OK: OpenVAS SCAP database found in /var/lib/openvas/scap-data/scap.db.
OK: OpenVAS CERT database found in /var/lib/openvas/cert-data/cert.db.
OK: xsltproc found.
Step 3: Checking user configuration ...
WARNING: Your password policy is empty.
SUGGEST: Edit the /etc/openvas/pwpolicy.conf file to set a password policy.
Step 4: Checking Greenbone Security Assistant (GSA) ...
OK: Greenbone Security Assistant is present in version 6.0.11.
Step 5: Checking OpenVAS CLI ...
OK: OpenVAS CLI version 1.4.4.
Step 6: Checking Greenbone Security Desktop (GSD) ...
SKIP: Skipping check for Greenbone Security Desktop.
Step 7: Checking if OpenVAS services are up and running ...
OK: netstat found, extended checks of the OpenVAS services enabled.
OK: OpenVAS Scanner is running and listening on all interfaces.
OK: OpenVAS Scanner is listening on port 9391, which is the default port.
OK: OpenVAS Manager is running and listening on all interfaces.
OK: OpenVAS Manager is listening on port 9390, which is the default port.
OK: Greenbone Security Assistant is running and listening on all interfaces.
OK: Greenbone Security Assistant is listening on port 443, which is the default port.
Step 8: Checking nmap installation ...
WARNING: Your version of nmap is not fully supported: 7.01
SUGGEST: You should install nmap 5.51 if you plan to use the nmap NSE NVTs.
Step 10: Checking presence of optional tools ...
OK: pdflatex found.
WARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.
SUGGEST: Install required LaTeX packages.
OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work.
OK: rpm found, LSC credential package generation for RPM based targets is likely to work.
OK: alien found, LSC credential package generation for DEB based targets is likely to work.
OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work.
It seems like your OpenVAS-8 installation is OK.
If you think it is not OK, please report your observation
and help us to improve this check routine:
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss
Please attach the log-file (/tmp/openvas-check-setup.log) to help us analyze the problem.
这个答案对于 OP 来说可能有点晚了，但万一未来的 Google 员工来到这里，这对我有用：
我还得出结论，当我的 OpenVAS 扫描突然停止时，过期的证书是问题所在 运行。使用 openvas-check-setup 命令告诉我一切都很好，但是当我尝试手动 运行 扫描时，我会收到相同的 503 服务不可用消息。查看日志（我的位置：/var/log/openvas/openvasmd.log）给了我一些线索，包括：
WARNING:2017-05-16 19h04.51 UTC:3687: Failed to gnutls_bye: Error in
the push function. WARNING:2017-05-16 19h04.52 UTC:3686:
openvas_server_verify: the certificate is not trusted
WARNING:2017-05-16 19h04.52 UTC:3686: openvas_server_verify: the
certificate has expired
我开始对 gnutls_bye 消息进行故障排除，因为错误这个词往往比警告更受关注，但最终证书才是问题所在。
我使用了 OP 的 mkcert 命令的变体来生成新证书，但我认为 s/he 缺少的步骤是使用这些新证书更新扫描仪配置。
所以我导航到证书文件位置 (cd /var/lib/openvas/) 和 运行 以下命令：
openvasmd --modify-scanner <UUID> --scanner-ca-pub CA/cacert.pem --scanner-key-pub CA/clientcert.pem --scanner-key-priv private/CA/clientkey.pem
您需要替换为您正在修改的扫描仪的实际 UUID。获取扫描仪列表：
openvasmd --get-scanners
作为最后的检查，您可以使用验证命令：
openvasmd --verify-scanner <UUID>
虽然它坏了，但我得到了
非常无用的回复
Failed to verify scanner.
但是一旦你成功更新了证书并与你的扫描仪相关联（并且你可能需要重新启动相关服务以备不时之需，或者像我一样走 lazy/nuclear 路线并重新启动服务器), 验证命令应该 return 类似于
Scanner version: OTP/2.0.
或任何 type/version 你是 运行。
FWIW，如果您在此处搜索 "Updating Scanner Certificates"：http://www.openvas.org/src-doc/openvas-manager/index.html
，则修改扫描仪步骤深埋在 OpenVAS 文档中
希望这对某人有所帮助！
所以我的证书在我的 Open VAS 安装上过期了。 因此，我在尝试 运行 扫描时遇到以下错误。
操作：启动任务 状态码：503 状态消息：服务暂时中断
我已经尝试重新创建证书：
me@ovas:~$ sudo /usr/sbin/openvas-mkcert -q -f
[sudo] password for me:
me@ovas:~$ sudo /usr/bin/openvas-mkcert-client -n -i
Generating RSA private key, 4096 bit long modulus
........................++
..................................................................................++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) []:Email Address []:Using configuration from /tmp/openvas-mkcert-client.28853/stdC.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'DE'
localityName :ASN.1 12:'Berlin'
commonName :ASN.1 12:'om'
Certificate is to be certified until Dec 5 12:38:09 2017 GMT (365 days)
Write out database with 1 new entries
Data Base Updated
me@ovas:~$
然后重启...
然后 Web 界面的一台已正确关闭，但扫描仪一台似乎不是？
这是在日志中：
lib serv:WARNING:2016-12-05 12h41.23 UTC:1533：无法与对等方握手：TLS 连接未正确终止。 事件 task:MESSAGE:2016-12-05 12h41.23 UTC:1533：target.me (3aca3163-3de2-4519-92af-f649f6bedd7c) 的任务扫描无法由 admin
启动检查打开 VAS 脚本输出：
openvas-check-setup 2.3.7
Test completeness and readiness of OpenVAS-8
(add '--v6' or '--v7' or '--v9'
if you want to check for another OpenVAS version)
Please report us any non-detected problems and
help us to improve this check routine:
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss
Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.
Use the parameter --server to skip checks for client tools
like GSD and OpenVAS-CLI.
Step 1: Checking OpenVAS Scanner ...
OK: OpenVAS Scanner is present in version 5.0.7.
OK: OpenVAS Scanner CA Certificate is present as /var/lib/openvas/CA/cacert.pem.
OK: redis-server is present in version v=3.0.6.
OK: scanner (kb_location setting) is configured properly using the redis-server socket: /var/run/redis/redis.sock
OK: redis-server is running and listening on socket: /var/run/redis/redis.sock.
OK: redis-server configuration is OK and redis-server is running.
OK: NVT collection in /var/lib/openvas/plugins contains 50525 NVTs.
WARNING: Signature checking of NVTs is not enabled in OpenVAS Scanner.
SUGGEST: Enable signature checking (see http://www.openvas.org/trusted-nvts.html).
OK: The NVT cache in /var/cache/openvas contains 50548 files for 50525 NVTs.
Step 2: Checking OpenVAS Manager ...
OK: OpenVAS Manager is present in version 6.0.9.
OK: OpenVAS Manager client certificate is present as /var/lib/openvas/CA/clientcert.pem.
OK: OpenVAS Manager database found in /var/lib/openvas/mgr/tasks.db.
OK: Access rights for the OpenVAS Manager database are correct.
OK: sqlite3 found, extended checks of the OpenVAS Manager installation enabled.
OK: OpenVAS Manager database is at revision 146.
OK: OpenVAS Manager expects database at revision 146.
OK: Database schema is up to date.
OK: OpenVAS Manager database contains information about 49328 NVTs.
OK: At least one user exists.
OK: OpenVAS SCAP database found in /var/lib/openvas/scap-data/scap.db.
OK: OpenVAS CERT database found in /var/lib/openvas/cert-data/cert.db.
OK: xsltproc found.
Step 3: Checking user configuration ...
WARNING: Your password policy is empty.
SUGGEST: Edit the /etc/openvas/pwpolicy.conf file to set a password policy.
Step 4: Checking Greenbone Security Assistant (GSA) ...
OK: Greenbone Security Assistant is present in version 6.0.11.
Step 5: Checking OpenVAS CLI ...
OK: OpenVAS CLI version 1.4.4.
Step 6: Checking Greenbone Security Desktop (GSD) ...
SKIP: Skipping check for Greenbone Security Desktop.
Step 7: Checking if OpenVAS services are up and running ...
OK: netstat found, extended checks of the OpenVAS services enabled.
OK: OpenVAS Scanner is running and listening on all interfaces.
OK: OpenVAS Scanner is listening on port 9391, which is the default port.
OK: OpenVAS Manager is running and listening on all interfaces.
OK: OpenVAS Manager is listening on port 9390, which is the default port.
OK: Greenbone Security Assistant is running and listening on all interfaces.
OK: Greenbone Security Assistant is listening on port 443, which is the default port.
Step 8: Checking nmap installation ...
WARNING: Your version of nmap is not fully supported: 7.01
SUGGEST: You should install nmap 5.51 if you plan to use the nmap NSE NVTs.
Step 10: Checking presence of optional tools ...
OK: pdflatex found.
WARNING: PDF generation failed, most likely due to missing LaTeX packages. The PDF report format will not work.
SUGGEST: Install required LaTeX packages.
OK: ssh-keygen found, LSC credential generation for GNU/Linux targets is likely to work.
OK: rpm found, LSC credential package generation for RPM based targets is likely to work.
OK: alien found, LSC credential package generation for DEB based targets is likely to work.
OK: nsis found, LSC credential package generation for Microsoft Windows targets is likely to work.
It seems like your OpenVAS-8 installation is OK.
If you think it is not OK, please report your observation
and help us to improve this check routine:
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss
Please attach the log-file (/tmp/openvas-check-setup.log) to help us analyze the problem.
这个答案对于 OP 来说可能有点晚了，但万一未来的 Google 员工来到这里，这对我有用：
我还得出结论，当我的 OpenVAS 扫描突然停止时，过期的证书是问题所在 运行。使用 openvas-check-setup 命令告诉我一切都很好，但是当我尝试手动 运行 扫描时，我会收到相同的 503 服务不可用消息。查看日志（我的位置：/var/log/openvas/openvasmd.log）给了我一些线索，包括：
WARNING:2017-05-16 19h04.51 UTC:3687: Failed to gnutls_bye: Error in the push function. WARNING:2017-05-16 19h04.52 UTC:3686: openvas_server_verify: the certificate is not trusted WARNING:2017-05-16 19h04.52 UTC:3686: openvas_server_verify: the certificate has expired
我开始对 gnutls_bye 消息进行故障排除，因为错误这个词往往比警告更受关注，但最终证书才是问题所在。
我使用了 OP 的 mkcert 命令的变体来生成新证书，但我认为 s/he 缺少的步骤是使用这些新证书更新扫描仪配置。
所以我导航到证书文件位置 (cd /var/lib/openvas/) 和 运行 以下命令：
openvasmd --modify-scanner <UUID> --scanner-ca-pub CA/cacert.pem --scanner-key-pub CA/clientcert.pem --scanner-key-priv private/CA/clientkey.pem
您需要替换为您正在修改的扫描仪的实际 UUID。获取扫描仪列表：
openvasmd --get-scanners
作为最后的检查，您可以使用验证命令：
openvasmd --verify-scanner <UUID>
虽然它坏了，但我得到了
非常无用的回复Failed to verify scanner.
但是一旦你成功更新了证书并与你的扫描仪相关联（并且你可能需要重新启动相关服务以备不时之需，或者像我一样走 lazy/nuclear 路线并重新启动服务器), 验证命令应该 return 类似于
Scanner version: OTP/2.0.
或任何 type/version 你是 运行。
FWIW，如果您在此处搜索 "Updating Scanner Certificates"：http://www.openvas.org/src-doc/openvas-manager/index.html
，则修改扫描仪步骤深埋在 OpenVAS 文档中希望这对某人有所帮助！