My company offers a product that utilizes a personal web certificate (pfx) as a secondary means to verify the user logging in (or more accurately, the computer). Most of the time, this works without problem. However, in the recent months there has been an uptick in the number of cases where an Antivirus, such as Kaspersky, uses a feature that scans encrypted connections, and this leads to the user not being allowed in.

Our servers show that these users are not presenting their certificate. If I walk them through outright disabling the HTTPS scanning, they will immediately be let in (server now "sees" the user's certificate). I understand that these Antivirus programs use their own certificate, and this tends to prevent the user from seeing the site's certificate. However, is this also the case to the server?

I guess my post/question here is twofold. Are antivirus programs preventing users from using their own certificates as authentication means to websites when this feature is enabled, and secondly, besides completely disabling the feature for every customer that calls in (note, these customers are small-to-large companies, under strict HIPAA and/or FCRA guidelines, I do not feel comfortable in encouraging disabling any security measures), is there another way, either in development of our product, or in the support of the customers, to get around this major roadblock?

I have a meeting on Monday where I discuss my findings, and would greatly appreciate any available feedback.

Courtesy note: I have done my best to offer up as much information as possible without breaching confidentiality. Please respect this, and do not attempt to guess the company I am working for. Thank you.

marked as duplicate by Steffen Ullrich tls Oct 20 '17 at 20:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • By "personal web certificate" I assume you're talking about client certs? Sounds like the anti-virus program is intercepting the user's connection to your server, then forming its own connection without utilizing the client certificate you gave the user. – Ajedi32 Oct 20 '17 at 20:10
  • "I guess my post/question here is twofold" - the first part is about using client certificates vs. SSL interception. This part is a duplicate and I've marked the question as such. If you still need answers to the second part after you've understood why client certificates and SSL interception do not play together well then please ask a new question which cares only about this part. – Steffen Ullrich Oct 20 '17 at 20:43