Not Activated Categorization Is Disabled Hot — Kerio Control Web Filter Is

  • Regular Backups: Before applying updates, back up the configuration (/var/kerio/winroute/backup.cfg). A corrupted urldb.conf file is a silent killer.
  • Avoid Deep Packet Inspection (DPI) on Filter Updates: If you use SSL inspection, create a bypass rule for traffic to the Kerio update servers, or install the Kerio CA certificate properly.

    • The firewall cannot resolve update.kwf.kerio.com or the category servers.

    The appliance must reach GFI's cloud categorization servers on HTTPS (TCP/443).

    SSH into the Kerio Control box (or use the web admin → Diagnostics → Shell) and run: Regular Backups: Before applying updates, back up the

    curl -v https://download.gfi.com/
curl -v https://update.gfi.com/

    Also test the license validation server:

    nslookup license.gfi.com

    Expected result: HTTP 200 or HTTP 403 (any response proves connectivity). The firewall cannot resolve update

    If connection fails:

    Via Admin Interface:

    Via SSH/Console (if needed):

    /opt/kerio/mailserver/kerio-categorization status
/opt/kerio/mailserver/kerio-categorization start

    Export block lists (e.g., from UT1) and import them as URL Rules in Kerio Control – though without categorization, you must manually update them. Also test the license validation server: nslookup license

    Sometimes the local database simply needs to be "kicked" to re-establish a connection with the cloud.

    To avoid this error in the future:

    Privacy Settings
    By using this site, you accept our Cookie Policy and Terms of Use.
  • Regular Backups: Before applying updates, back up the configuration (/var/kerio/winroute/backup.cfg). A corrupted urldb.conf file is a silent killer.
  • Avoid Deep Packet Inspection (DPI) on Filter Updates: If you use SSL inspection, create a bypass rule for traffic to the Kerio update servers, or install the Kerio CA certificate properly.

    • The firewall cannot resolve update.kwf.kerio.com or the category servers.

    The appliance must reach GFI's cloud categorization servers on HTTPS (TCP/443).

    SSH into the Kerio Control box (or use the web admin → Diagnostics → Shell) and run:

    curl -v https://download.gfi.com/
curl -v https://update.gfi.com/

    Also test the license validation server:

    nslookup license.gfi.com

    Expected result: HTTP 200 or HTTP 403 (any response proves connectivity).

    If connection fails:

    Via Admin Interface:

    Via SSH/Console (if needed):

    /opt/kerio/mailserver/kerio-categorization status
/opt/kerio/mailserver/kerio-categorization start

    Export block lists (e.g., from UT1) and import them as URL Rules in Kerio Control – though without categorization, you must manually update them.

    Sometimes the local database simply needs to be "kicked" to re-establish a connection with the cloud.

    To avoid this error in the future: