1089864 - (Error code: sec_error_unknown_issuer) when ESET SMART SECURITY 8 "Always scan SSL protocol" is enabled

Status: RESOLVED DUPLICATE of bug 1265113

(Core :: Security: PSM, defect)

Description

[Alice0775 White]

Steps to reproduce:
1. Install ESET SMART SECURITY 8
2. Advanced setup > Web and email > Protocol filtering > SSL 
    Check "Always scan SSL protocol", then OK

3.Start Firefox
4. Open about:addons , then Select  "Get Add-ons" Pane
    OR https://bugzilla.mozilla.org/ etc

Actual Results
Error code: sec_error_unknown_issuer

Comment 1

[:Gijs (he/him)]

This sounds like ESET man-in-the-middles everything with a cert signed by an unknown authority. It's probably ESET's job to put the relevant CA in the cert store, and even then I'd be surprised if this worked with cert pinning etc...

Not really sure what the expected behaviour here would be. Alice, what do you think we should be doing?

Comment 2

[Alice0775 White]

Honestly, I think there is a responsibility to ESET.

Firefox fails to connect  https://www.google.com .
However,  Chrome and IE can connect https://www.google.com .
So, Mark [parity-Chrome][parity-IE].

Fortunately, The "scan SSL protocol" is not default setting of ESET.

Comment 3

[Dmitry]

My thoughts are that this is FF issue.

We have same problems in our selfdeveloped application for sniffing https traffic (MITM yes, but sertificate was corractly created via cert center).
Everything works fine with chrome and IE, only FF have problems (sec_error_unknown_issuer).

So, if every browser telling us that our sert is correct, and only FF told that it is not, i think this is defect of FF not others... .

Comment 4

[Dmitry]

My perviose comment is incorrect.

Comment 5

[alex_mayorga]

¡Hola Alice!

Would it be possible for you to attach the problematic certificate from ESET to this bug?

Confirming as a user popped with this issue on IRC at #firefox

¡Gracias!
Alex

Comment 6

[Alice0775 White]

Sorry, I do not have a test environment now.....

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

This should be fixed by bug 1265113 (and setting the new pref "security.enterprise_roots.enabled" to true).