Don't use ESET SSL protocol filtering
One of my clients recently received an email from a customer complaining that the client's SSL certificate was producing warnings in their antivirus software. Obviously concerned I checked the site and it's certificate only to find everything was fine. The certificate signing chain was properly signed by a valid certificate authority and the certificate was still in date.
Probing the customer further revealed that they only saw the warning when using their home machine with ESET antivirus installed. A quick search revealed a number of users having issues with the ESET SSL protocol checking / filtering feature showing false positives and this person who saw invalid certificate errors due to an error installing the ESET root certificate authority. Wait a minute, why would you need to install a new root certificate authority? And why, when it wasn't installed, would you see invalid certificate errors on all websites using SSL?
Well, for those who haven't realised yet, ESET SSL protocol checking installs a new root certificate authority that is used to intercept all secure connections on your computer and check the contents. It completely breaks the security offered by SSL by intercepting the connection and inspecting the contents.
This means that the proprietary ESET antivirus application is performing a man in the middle (MITM) attack on you, and has the ability to view and alter the contents of any secure web pages you visit, including any passwords you enter, any personal information that travels along the connection, any applications or files you download and so on.
Not only that, the ESET application downloads page (and the download itself) is served over unencrypted HTTP, meaning malicious actors can easily serve up modified and/or malicious versions of the ESET application without raising suspicion.
This is a little worrying for an application that will be installed with administrator privileges on your computer.
Anyway, back to the SSL interception. After installation, visiting the advanced settings panel shows that SSL protocol interception is turned off by default. This is a good default setting and if you have ESET installed and have never changed this setting it's safer to leave it as it is (i.e. off).
If you turn it on, it will ask for administrator access to your machine. It doesn't say what this is for, but it is so it can install it's own certificate authority in all your browsers and the operating system itself.
Once the option is switched on you can see the certificate intercepting all SSL websites you visit.
This is bad because not only has the ESET application got full access to your communications, it is giving you a false sense of security as the browser will show the SSL padlock and tell you the connection is fine.
Not only that, inspecting SSL negotiation with Wireshark shows the ESET application actually downgrades your SSL connection to TLSv1.0 even if your browser and the site you are visiting would normally use the much stronger TLSv1.1 or TLSv1.2.
You may remember that TLSv1.0 is vulnerable to the BEAST attack and should generally not be used.
The screenshot above shows the latest version of Chrome connecting to Google.com with ESET SSL protocol filtering turned on.
And here is the same version of Chrome connecting to Google.com without ESET filtering.
Interestingly, I thought the interception would not work on Google's Chrome browser as it implements certificate pinning. This means it performs extra checks to make sure the browser will only connect to Google sites when they use an SSL certificate that has Google's own certificate authority in it's signing chain. However, it appears that Chrome will make exceptions for certificate authorities you have installed yourself.
So, should you use ESET SSL protocol filtering? In my opinion, no. Leave it switched off. It isn't worth giving a proprietary program access to view and alter all your secure communications on the off-chance it might catch a threat occasionally. It also results in false-positives, claiming that valid certificates have issues and should not be trusted. If you want to take advantage of the part of this feature that restricts using SSLv2, then there you should use your browser settings to do this instead of using ESET.
ESET themselves advise you switch the feature off, and provide instructions here.