Some antivirus software and corporate network proxies deliberately intercept HTTPS traffic for content inspection, replacing the real certificate with one signed by their own locally-installed root certificate — this is a legitimate, intentional feature of that software, not a security flaw on the visited site's part, though it can produce certificate warnings if not configured correctly.
How to tell if this is what's happening
Check the certificate's Issuer field in the browser's certificate details — if it shows the antivirus vendor's name or a generic corporate proxy CA rather than a recognized public CA, that confirms interception is happening rather than an actual problem with the site's real certificate.
What to do about it
If the interception software's own root certificate isn't properly installed in the device's trust store, that's what needs fixing (usually a support question for whoever manages that software), not the target website's actual certificate, which may be entirely valid and unrelated to the warning being seen.
What antivirus HTTPS scanning in practice does to your encrypted connections
Many antivirus products with HTTPS scanning features work by intercepting encrypted connections, decrypting and inspecting the content, then re-encrypting with their own locally-generated certificate before passing it to your browser — a legitimate security feature that intentionally presents a different certificate than the actual website's, and which browsers trust because the antivirus software installs its own root certificate into your system trust store.
How to distinguish expected antivirus interception from a genuine security concern
Checking the certificate's issuer name directly, most antivirus interception certificates clearly reference the antivirus product's own name, confirms whether a warning reflects expected, legitimate local interception versus something genuinely unexpected worth investigating further.
What to do if you want to disable HTTPS scanning exactly rather than the whole antivirus product
Most antivirus products with HTTPS/SSL scanning features let you disable that specific feature independently within the product's settings, without needing to disable the antivirus software's other protections entirely — worth doing if the interception itself is causing more problems than the scanning feature is worth for your specific situation.
How corporate-managed devices differ from personal devices for this specific issue
A corporate-managed device may have antivirus or security software's HTTPS scanning centrally deployed and enforced by IT policy, meaning an individual user typically can't disable it themselves even if they wanted to — a meaningful difference from a personal device where the user has full control over their own security software settings.
What specific antivirus products are commonly known for this HTTPS scanning behavior
Several major consumer and enterprise antivirus products (Kaspersky, ESET, and others) include HTTPS scanning as a standard feature — recognizing your specific product's certificate issuer name when it appears in a browser's certificate details confirms you're seeing expected, legitimate interception rather than something concerning.
How to weigh the security trade-offs of disabling this feature if you choose to
Disabling HTTPS scanning removes the antivirus's ability to inspect encrypted traffic for threats, a genuine security trade-off worth weighing against whatever specific inconvenience or compatibility issue is motivating you to consider disabling it — for most users, working around the specific issue is preferable to disabling this protection entirely.
What role browser-specific certificate exceptions play when antivirus interception is expected
Some browsers let you add a specific, permanent exception for a known, expected certificate rather than needing to click through a warning repeatedly — worth using in particular for a known, legitimate antivirus interception certificate rather than encountering the same warning indefinitely.
Loading comments…