# Antivirus HTTPS scanning SSL errors: how to confirm and fix

> Antivirus web protection that scans HTTPS re-signs certificates and can cause SSL errors on every site. How to confirm it and fix it without losing protection.

Source: https://ssl.sh/errors/antivirus-https-scanning-ssl-error/
Last updated: 2026-11-10

**Antivirus and internet security suites that scan HTTPS sit between your browser and every website, replacing each site's certificate with one they sign themselves.** When the product's root certificate is missing from your browser, outdated or misconfigured, you get certificate errors on many sites at once. It is a local problem, not the websites'.

## Is it the site or your device?

It is your device: the security product causes the errors, not the sites. Confirm it by checking any failing site with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

If the checker shows a normal public certificate, open the certificate in your browser (click the warning's details or the padlock) and read the **Issued by** field. A name containing your security product's brand, or words like "Web Shield", "SSL scanning" or "Personal Root", confirms local interception.

## Causes

### 1. Root not installed in the browser's store

The product added its root to Windows or macOS but not to Firefox, or a browser update reset the integration. Chrome works, Firefox fails, or the other way round.

### 2. Outdated product generating rejected certificates

Old versions may use SHA-1 signatures, weak keys or missing extensions that modern browsers refuse ([NET::ERR_CERT_INVALID](https://ssl.sh/errors/net-err-cert-invalid/), [NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM](https://ssl.sh/errors/net-err-cert-weak-signature-algorithm/)).

### 3. Root removed or expired

Cleaning tools, a profile reset or the root's own expiry can leave the product signing with a root nobody trusts.

### 4. Bugs with modern TLS

Some interception engines mishandle TLS 1.3, HTTP/2 or new key exchange mechanisms, causing [ERR_SSL_PROTOCOL_ERROR](https://ssl.sh/errors/err-ssl-protocol-error/) or [PR_END_OF_FILE_ERROR](https://ssl.sh/errors/pr-end-of-file-error/).

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Chrome / Edge | [NET::ERR_CERT_AUTHORITY_INVALID](https://ssl.sh/errors/net-err-cert-authority-invalid/) on many sites, or protocol errors |
| Firefox | [MOZILLA_PKIX_ERROR_MITM_DETECTED](https://ssl.sh/errors/mozilla-pkix-error-mitm-detected/) or [SEC_ERROR_UNKNOWN_ISSUER](https://ssl.sh/errors/sec-error-unknown-issuer/) |
| Safari | "This Connection Is Not Private" |
| Apps (Git, Python, Java) | Certificate verification failures on every HTTPS request |

## How to fix it on your computer

Updating or reconfiguring the security product fixes it; uninstalling it is rarely necessary.

**1. Update the security product** to the latest version and restart the browser.

**2. Use the product's repair option** for browser integration, if it has one.

**3. Turn off only the HTTPS scanning feature.** Look in the web protection settings for an option named like "HTTPS scanning", "scan encrypted connections", "SSL/TLS filtering" or "encrypted web scan". Leave real-time file protection on.

**4. For Firefox,** enable `security.enterprise_roots.enabled` in `about:config` only if you want Firefox to trust the product's root, and only after confirming that root belongs to software you installed.

**5. Remove leftover roots** from uninstalled products (Windows: `certmgr.msc` > Trusted Root Certification Authorities; macOS: Keychain Access > System).

## How site owners fix it

Nothing on the server needs to change if `curl ssl.sh/example.com` shows a valid chain. Support teams can recognise this case by the issuer name in a customer's screenshot.