Antivirus warning: Invalid certificate

[e-t-l]

Kaspersky Security Cloud keeps flagging dnscrypt-proxy.exe and trying to disconnect it. It gives me the following message:

Cannot guarantee authenticity of the domain to which an encrypted connection is being established
Event: SSL connection with invalid certificate detected
Application: dnscrypt-proxy.exe
URL: rdns.faelix.net
Reason: This certificate or one of the certificates in the certificate chain is not up to date.

If I try to ignore it, it pops up back up, sometimes immediately and sometimes after a few minutes. The only other option given to me is "Disconnect" which I'd rather not do, since I'm pretty sure that would stop dnscrypt-proxy from working properly.

Does anyone know what rdns.faelix.net is and why I'm getting this certificate error?

[jedisct1]

Faelix's DoH certificates expired, and they have been temporarily removed from the public lists.

Their DNSCrypt servers are fine, though.

Now, the fact that you got that error from some cloud service instead of dnscrypt-proxy itself is concerning. If they hijack all your HTTPS traffic, including non-web traffic, I wouldn't trust any response from a DoH server.

[e-t-l]

Thanks for the explanation! That's reassuring to hear.

Point of clarification: Kaspersky Security Cloud is an endpoint antivirus program like MalwareBytes, Comodo, etc. They put the "cloud" in their name to sound more sophisticated, I think, and because some things (virus databases, etc) are synced with a cloud server. It's still primarily an offline AV program, and I believe it's a firewall-related security feature that's throwing this warning, because it monitors the authenticity of certificates (something which, by itself, is a good feature I'd prefer not to disable).

I haven't tinkered much with dnscrypt-proxy's settings. Is there some alternative (i.e. non-expired) server I can connect to instead of Faelix?

[jedisct1]

If Faelix worked well for you, Just remove -doh from the name; they are still perfectly accessing via DNSCrypt.