So what's happening here is that Kaspersky is not properly MITM'ing FireFox, so when FireFox gets fed certs issued by Kaspersky's CA, it's throwing all the alarms and screaming at you that you're under attack. You can see how easy this is to do in a C# function I wrote here.

This does not require the user to accept it, nor does it even alert the user that this has happened. You can simply compile the open source Mozilla NSS package and, included in it is a utility called CertUtil that can transparently inject certificates, even root CAs, into FireFox's trusted cert store. What's cute about this is that it's not actually adding any security whatsoever. Instead, FireFox is distributed with a complete list of all CAs that Mozilla trusts. It refuses to trust your OS's cert store, precisely because its so easy to simply install a fake CA into it and start MITM'ing peoples connections. Modern browsers are so good that they can remember when a website.

If that authority is not there, boom, you get this error.įireFox is the only mainstream web browser that is paranoid. Basically, those networks cant tap into your connection just like attackers cant. The reason why it needs to install it into the OS certificate store is because this is where most software looks to validate that the Certificate Authority who has issued the certificate it has received is a valid, trusted Authority. Kaspersky also has to install this CA into your operating system's Trusted Certificate store. In order for this to be done correctly, Kaspersky has to generate its own root CA certificate, and generate spoofed certificates on the fly, feeding them to your browser. It does this in order to be able to scan payloads in HTTP transactions, be it in the request or the response. Here first restart the Firefox browser in Safe Mode with addons disabled by going to Menu->Help- and then click Restart with Add-ons Disabled. Kaspersky, like most AV products these days, is performing a local MITM against your secure HTTP traffic. It may happen that some add-ons are causing this Secure Connection Failed error in your firefox browser.

Firefox says insecure connection