I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in which case my certs are flagged as untrusted.
I can manually turn off SSL scanning, or add my certificate to the CTL that they use for mitm, or sign my certificates with their fake root cert and key. None of these options are any good if I want to deploy my application to remote users who may use other AV's
The AV has its own CTL to which I have not added my root cert, so I am wondering how the AV gets the browser/OS to use this alternate CTL and can this be overridden?