1362435 - ssl mitm protection (virusscanner for example)

Status: RESOLVED DUPLICATE of bug 1135776

(Firefox :: Security, defect)

Description

[djmaze]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20170322093849

Steps to reproduce:

Install ESET product with "Enable SSL/TLS protocol filtering" turned on
Visit a website with a Let's Encrypt certificate
Visit the website again after 3 months


Actual results:

The ESET MITM SSL certificate expired so the website is not accessible.
Warning about expired SSL certificate
User thinks the website is at fault, yet it is the ESET program MITM


Expected results:

Either:
A. warn users about the MITM
B. don't allow injection of root certificates so that any program (like ESET) are not allowed to do an SSL MITM at all
C. have an SSL fingerprints database that firefox can lookup for verification

Solutions that can be manipulated:
D. provide a JavaScript interface so that websites can show/check the SSL fingerprint
E. send/receive (encrypted) fingerprint information in header

Comment 1

[Dana Keeler (she/her) [:keeler]]

This is a flaw in ESET. In general, if there's a local proxy intercepting your traffic, there's not much Firefox can do if it doesn't use valid (albeit signed by an imported root) certificates. For an improved UI in these cases, see bug 1135776.