I am using Bitdefender AV 2013 ed and I have noticed that when the Scan SSL is enabled in the configuration BD will use a local certificate, as mentioned here. This modifies the cert chain with BD as the trusted root on secured sites, or at least that's what you see. My questions are:

1) What is this kind of technology called?

2) What is actually taking place behind the scenes with cert validation?

3) Is BD masking the actual cert chain or does it actually substitute its own root for the site based on doing its own checks then tells the browser its "trusted"?

4) Is the presenting server involved in this process in any way or is it oblivious to what the client is doing?


Bitdefender is doing here a Man-in-the-Middle attack, except that it is not really an "attack" since you actually consent to it. Bitdefender impersonates you when it talks to the server, and impersonates the server when it talks to your browser. This requires Bitdefender to create on-the-fly a fake certificate for the target server; your browser is fooled by it because Bitdefender added its own CA certificate to the set of roots trusted by your browser. That CA is, really, operated by Bitdefender itself.

All of this occurs locally on your own computer. There are two SSL connections, one between your browser and the local Bitdefender process, and one between Bitdefender and the remove server. Bitdefender forwards data back and forth, and can see it all plainly, which is the point of the exercise.

The remote server is blissfully unaware of these shenanigans.

  • So its acting like an SSL proxy, or something like that. What are the advantages of having BD scan the encryption layer as opposed to not? Do the pro's outweigh the cons? How effective are these tools in actually making your connection more secure? – user53029 Aug 3 '14 at 23:05
  • Also - I am still a bit confused on how this is allowed to work. I can see how the SSL handshake could take place, since the keys used for encryption are both linked to the same "fake" Bitdefender certificate. But is there no mechanism on the servers TLS stack that can say "hey, this connection here is pulling data from our secure website but I don't see where I ever sent over OUR keys? What am I missing? – user53029 Aug 3 '14 at 23:51
  • Bitdefender acted as a server in accepting (and terminating) the connection from your browser, and as a client in connecting to the real server. The real server sees a quite normal connection* from your computer, it just isn't actually from your browser. That's what man-in-the-middle means. * For most websites today which have hundreds or thousands of JS, CSS, IMG, AJAX, etc, etc, there will probably be multiple connections, but each one following the principles above. – dave_thompson_085 Aug 4 '14 at 6:45
  • The main pro clearly is that Bitdefender can scan HTTPS content from websites the same as HTTP content, and thus catch any viruses, malware, etc in HTTPS content that it can catch in HTTP. Other than a probably small performance hit, the only apparent con is that your browser doesn't see the exact details of the SSL connection; most of these don't matter most of the time, but unless the Bitdefender people are very careful this may prevent you from using SSL-client authentication (aka client certificate) with webservers that require or prefer it, which very few do. – dave_thompson_085 Aug 4 '14 at 6:52
  • Thanks Dave - Ok, so there's a key exchange going on between my browser and Bitdefender acting as the server, using the public/private keys from the "fake" certificate, then Bitdefender makes an SSL handshake with the real server using the servers public/private keys which is how content from the server is delivered to my PC from the actual server? Would this be an accurate description? – user53029 Aug 4 '14 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.