SSL/TLS

ESET Endpoint Antivirus is capable of checking for threats in communication that use the SSL protocol. You can use various scanning modes to examine SSL-protected communication with trusted certificates, unknown certificates, or certificates that are excluded from SSL-protected communication checking.

Enable SSL/TLS protocol filtering – Protocol filtering is enabled by default. You can disable SSL/TLS protocol filtering in Advanced setup > Web and email > SSL/TLS or via policy. If protocol filtering is disabled, the program will not scan communication over SSL.

SSL/TLS protocol filtering mode is available in the following options:

The List of SSL/TLS filtered applications can be used to customize ESET Endpoint Antivirus behavior for specific applications.

The List of known certificates allows you to customize ESET Endpoint Antivirus behavior for specific SSL certificates.

Exclude communication with trusted domains – When enabled, communication with trusted domains will be excluded from checking. The trustworthiness of a domain is determined by a built-in whitelist.

Block encrypted communication utilizing the obsolete protocol SSL v2 – Communication using the earlier version of the SSL protocol will automatically be blocked.

Root certificate

Root certificate – For SSL communication to work properly in your browsers/email clients, it is essential that the root certificate for ESET be added to the list of known root certificates (publishers). Add the root certificate to known browsers should be enabled. Select this option to automatically add the ESET root certificate to known browsers (for example, Opera and Firefox). For browsers using the system certification store, the certificate is added automatically (for example, in Internet Explorer).

To apply the certificate to unsupported browsers, click View Certificate > Details > Copy to File and manually import it into the browser.

Certificate validity

If the certificate trust cannot be established—In some cases, a website certificate cannot be verified using the Trusted Root Certification Authorities (TRCA) store (for example, expired certificate, untrusted certificate, certificate not valid for the specific domain or signature that can be parsed but does not sign the certificate correctly). Legitimate websites will always use trusted certificates. If they are not providing one, it could mean that an attacker is decrypting your communication or the website is experiencing technical difficulties.

If Ask about certificate validity is selected (selected by default), you will be prompted to choose an action when encrypted communication is established. An action selection dialog will be displayed where you can mark the certificate as trusted or excluded. If the certificate is not present in the TRCA list, the window is red. If the certificate is on the TRCA list, the window will be green.

You can select Block communication that uses the certificate to always terminate an encrypted connection to a site that uses an untrusted certificate.

If the certificate is corrupt—A corrupted certificate means that the certificate uses a format not recognized by ESET Endpoint Antivirus or has been received damaged (for example, overwritten by random data). In this case, we recommend leaving Block communication that uses the certificate selected. If Ask about certificate validity is selected, the user is prompted to choose an action when the encrypted communication is established.