SSL Scanning Behind SSL Inspection Firewall

[dlcrow]

Some times my computer is connected to a network that has an SSL inspection firewall which performs many of the same functions in the same way as the secure connection scanner in Avast.  Basically a local CA is created and used in the certificate chain.

Since I do use my computer outside of this environment, I do not want to turn off Avast's secure connection functionality so that I am always protected even if doubly so at times.

To make this environment work, I need to install a CA certificate into Avast's CA store.  It appears that Avast uses /Library/Application Support/Avast/config/CA/trusted as its store, but merely adding a pen for the CA into this directory doesn't seem to be enough for Avast to trust certificates presented by the SSL inspection firewall.  Without that, Avast will present its untrusted certificate to the browser.

Is there a way to install additional CA certificates for use by Avast?

[ondrej.kolacek]

Hello,

Avast verifies the certificates against Mac OS X certificate store, like Safari does. As long as the certificate of the SSL inspection firewall is installed as a root CA authority certificate in Mac's keychain, all should work. This means that as long as certificates work correctly in Safari without Avast web shield, they should also work with it active.

Kind regards,
Ondrej Kolacek

[dlcrow]

Thank you for the reply, but that does not match the behavior that I am seeing.

Using the Keychain Access app, I can see the CA certificate for my firewall alongside the Avast trusted CA as a certificate in the System Keychain.

With Avast active, but the web shield disabled, I can load a URL and see the certificate chain by clicking on the lock icon in the URL location field shows my firewall generated certificate, an intermediate CA, and the root CA which corresponds to what is in they Keychain.

However, when I enable the Avast web shield and shift-reload the URL, the chain is not a chain at all and just shows the Avast untrusted CA certificate.

Is there a way to trace the Avast web shield to see what certificate authorities it knows about?

[dlcrow]

Upon further review, I do see that my firewall certificate is "trusted for this account" and the Avast trusted CA is "trusted for all users".  I was able to change the certificate from "always trust" to "use system default" and the certificate became "trusted for all users" and things now appear to work as expected.

Thanks for the information!