I have a multiplatform client plugin that has its own trust store (ie this client app does not trust the OS trust store) that is used to talk to a webservice over TLS.
Clients that have Avast Antivirus complained about getting connection errors. Studying the Avast I identified that the origin of the problem is HTTPS monitoring: Avast does a MITM attack to be able to scan the connection, using a new cert generated by a local CA that the software controls for this. It only applies to connections that leave a browser (ie if I load the plugin from another software it works fine, looks like Avast does not interfere with that), but in the browser case the connection will fail because we do not trust the system trustore where the CA certificate is injected.
Well, while I dont like at all Avast implementation for this, and think it is very abusive and maybe even dangerous, I don´t se from their docs and public info that they would whitelist me (only would do it for banks) and I do understand I´m quite an exception case (most things that connect out from a browser trust the system truststore). And I don´t like the idea of having to guide each user that faces this how to whitelist manually our site on their avast config (its on our FAQ already, but anyway, most wont read it).
So I need to workaround this, and I would not like to do that by trusting the system store, neither dropping current security level. I think I could add some windows specific code to find something that looks like Avast MITM CA and trust it, but looks ugly and probably insecure, since each instalation has its own CA (I hope at least) and therefore I only could identify it by name (who knows when it will change?), anyway that is not really a good way to identify a certificate to trust.
Does anyone has any different idea on how to workaround this?
