Phones and operating systems
Antivirus HTTPS scanning SSL errors: how to confirm and fix
NET::ERR_CERT_AUTHORITY_INVALID / SEC_ERROR_UNKNOWN_ISSUER (certificate issued by antivirus)Antivirus and internet security suites that scan HTTPS sit between your browser and every website, replacing each site's certificate with one they sign themselves. When the product's root certificate is missing from your browser, outdated or misconfigured, you get certificate errors on many sites at once. It is a local problem, not the websites'.
Is it the site or your device?
It is your device: the security product causes the errors, not the sites. Confirm it by checking any failing site with the SSL checker:
curl ssl.sh/example.com
If the checker shows a normal public certificate, open the certificate in your browser (click the warning's details or the padlock) and read the Issued by field. A name containing your security product's brand, or words like "Web Shield", "SSL scanning" or "Personal Root", confirms local interception.
Causes
1. Root not installed in the browser's store
The product added its root to Windows or macOS but not to Firefox, or a browser update reset the integration. Chrome works, Firefox fails, or the other way round.
2. Outdated product generating rejected certificates
Old versions may use SHA-1 signatures, weak keys or missing extensions that modern browsers refuse (NET::ERR_CERT_INVALID, NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM).
3. Root removed or expired
Cleaning tools, a profile reset or the root's own expiry can leave the product signing with a root nobody trusts.
4. Bugs with modern TLS
Some interception engines mishandle TLS 1.3, HTTP/2 or new key exchange mechanisms, causing ERR_SSL_PROTOCOL_ERROR or PR_END_OF_FILE_ERROR.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Chrome / Edge | NET::ERR_CERT_AUTHORITY_INVALID on many sites, or protocol errors |
| Firefox | MOZILLA_PKIX_ERROR_MITM_DETECTED or SEC_ERROR_UNKNOWN_ISSUER |
| Safari | "This Connection Is Not Private" |
| Apps (Git, Python, Java) | Certificate verification failures on every HTTPS request |
How to fix it on your computer
Updating or reconfiguring the security product fixes it; uninstalling it is rarely necessary.
1. Update the security product to the latest version and restart the browser.
2. Use the product's repair option for browser integration, if it has one.
3. Turn off only the HTTPS scanning feature. Look in the web protection settings for an option named like "HTTPS scanning", "scan encrypted connections", "SSL/TLS filtering" or "encrypted web scan". Leave real-time file protection on.
4. For Firefox, enable security.enterprise_roots.enabled in about:config only if you want Firefox to trust the product's root, and only after confirming that root belongs to software you installed.
5. Remove leftover roots from uninstalled products (Windows: certmgr.msc > Trusted Root Certification Authorities; macOS: Keychain Access > System).
How site owners fix it
Nothing on the server needs to change if curl ssl.sh/example.com shows a valid chain. Support teams can recognise this case by the issuer name in a customer's screenshot.
FAQ
Is turning off HTTPS scanning unsafe?
It removes one layer of web filtering, but your browser still checks certificates and blocks known malicious sites, and the antivirus still scans files you download and run. Many security experts consider HTTPS interception a net risk when it is buggy. Turning it off restores normal certificate validation; it does not disable the antivirus.
Why does only Firefox complain?
Firefox uses its own root store. If the antivirus did not register its root with Firefox, only Firefox sees an untrusted certificate. Firefox may report this as MOZILLA_PKIX_ERROR_MITM_DETECTED.
Should I install the antivirus root certificate manually?
Only if it comes from the product's own repair function or official documentation. Never install a root certificate offered by a website.
Errors started right after an antivirus update. What should I do?
A new version may have regenerated its root certificate or changed how it integrates with browsers. Restart the computer so every browser picks up the new root, then run the product's browser repair option if it has one. If errors continue, temporarily turn off HTTPS scanning, report the issue to the vendor, and re-enable the feature once a fix is released.