I think I could add some windows specific code to find something that looks like Avast MITM CA and trust it, but looks ugly and probably insecure, since each instalation has its own CA (I hope at least) and therefore I only could identify it by name (who knows when it will change?), anyway that is not really a good way to identify a certificate to trust. What version of avast are you using, current release version is 2016. So I need to workaround this, and I would not like to do that by trusting the system store, neither dropping current security level. And I don´t like the idea of having to guide each user that faces this how to whitelist manually our site on their avast config (its on our FAQ already, but anyway, most wont read it). Well, while I dont like at all Avast implementation for this, and think it is very abusive and maybe even dangerous, I don´t se from their docs and public info that they would whitelist me (only would do it for banks) and I do understand I´m quite an exception case (most things that connect out from a browser trust the system truststore). It only applies to connections that leave a browser (ie if I load the plugin from another software it works fine, looks like Avast does not interfere with that), but in the browser case the connection will fail because we do not trust the system trustore where the CA certificate is injected. Studying the Avast I identified that the origin of the problem is HTTPS monitoring: Avast does a MITM attack to be able to scan the connection, using a new cert generated by a local CA that the software controls for this. yes/no() Block OLE2 files with VBA macros -nocerts Disable authenticode certificate chain verification in PE files.

I have a multiplatform client plugin that has its own trust store (ie this client app does not trust the OS trust store) that is used to talk to a webservice over TLS.Ĭlients that have Avast Antivirus complained about getting connection errors.

Avast certificate error 4 2016