Starting in Firefox 68, to address user frustration with the complexity of configuring security software, a workaround was added for MITM's. You can disable the automatic workaround. The steps are in this article:

How to disable the Enterprise Roots preference

If those two preference changes do not resolve the issue, you could check for either an autoconfig file or a policies.json file forcing the enterprise cert preference.

• Customize Firefox using AutoConfig
• Customize Firefox using policies.json

It is likely that your security software uses GPO rules to enforce adding its root certificate to Firefox if you enable HTTPS scanning. It is not Firefox's fault if you have (security) software that (mis)uses GPO rules in the Windows Registry to configure Firefox. If you do not trust this software then you need to look for other security software or keep this feature disabled.

• https://support.mozilla.org/en-US/kb/error-codes-secure-websites

@jscher2000: thank you for you answer. https://support.mozilla.org/en-US/kb/how-disable-enterprise-roots-preference was part of the solution I tried and illustrated in the first post. Unfortunately, not only it doesn't work, but as soon as I restart the pc, all changes are ignored and previous values restored. I tried also using AutoConfig and policies.json, anyway until now without luck ("eicar.com" test-virus is always detected by Avast before downloading it using SSL)

@cor-el: yes, in my opinion is Firefox's fault to allow an external software to misuses GPO rules WITHOUT notifying the user ("about:policies#active" empty, and I repeat I also deleted Avast certificate) ..or without letting the user choose if an external software can use GPO rules. I made this test NOT because I want to go on using Avast (after https://www.cnet.com/news/antivirus-firm-avast-is-reportedly-selling-users-web-browsing-data/ I personally do not trust anymore in this company, although at least in my case I had taken steps to disable personal data sharing). I was trying to understand how is it possible that an external software can change some key configurations in Firefox and allowing MITM, without the user knowing.

Hi giotangi,

Yes it's annoying, but look at the flip side. If you're an IT admin and you want to install a root CA, then you don't really want Firefox to earn all your users about it. First, because it will confuse them. And more importantly, because telling them to ignore the warning is dangerous as it teaches your staff to ignore security warnings. This warning fatigue is a real security issue in and if itself.

As powerusers, we empathize with your position. However, we have to make systems that work well for everyone what. That is hard.

giotangi said

...as soon as I restart the pc, all changes are ignored and previous values restored. I tried also using AutoConfig and policies.json, anyway until now without luck...

It sounds as though Avast is overwriting your Autoconfig file with its own instructions at startup.

@Matthew Thomas: in some ways I could agree with your point of view, but in general I think that the security issues of such an approach are higher than the advantages it can give in some specific cases. Obviously it's just my point of view. It would be enough to give the user the possibility to choose (even as like now by default) through a checkbox somewhere (for example in about:policies) or through an entry in the about:config (that obviously cannot be overwritten from outside/regedit). Sorry but a similar approach seems to me the easiest way for a mass surveillance.. ads, behavior statistics, NSA and similar. Well, just joking, but not so far from what an antivirus or similar third party software could actually do without the user even knowing it (for example "about:policies#active" was empty). I speak as a fan of Firefox, not to denigrate it.

@jscher2000: yes, seems to be in fact

Firefox can't disallow anything which your operating system allows, especially to a program (or the OS) which has SYSTEM privilege level, which is something AVs rather tend to have. (An AV operates entirely by being a MITM in your OS, with system-level drivers and hooks.)

I wasn't speak about this. I said that the user must be notified (at a certain point, after regedit modification, I wasn't) and that I don't understand why there is no way to force Firefox not going through Avast, for example uninstalling the Avast certificate (apparently it is deleted but in fact it is used)

giotangi said

I wasn't speak about this. I said that the user must be notified (at a certain point, after regedit modification, I wasn't) and that I don't understand why there is no way to force Firefox not going through Avast, for example uninstalling the Avast certificate (apparently it is deleted but in fact it is used)

It's all related though. With the system access that Avast has, it could just replace Firefox with a keylogging version that contains no warnings.[1] From a "bad-actor" security perspective, such a warning doesn't really add to your security. It is, however, mildly annoying.

Basically, as crankygoat implied, there is nothing Firefox can do about a bad actor with system access.

Additionally Windows does not notify you about registry edits. Firefox does not do this either because it is a browser -- not a registry monitoring utility, anti-virus, or security suite.

[1] One of my friends actually had such an issue with a fake build of Chromium disguised as Chrome.

I had Avast on my last computer, and it basically ruined it. It installed Chrome, which I didn't want, and I deleted it but, as you said about Avast, it didn't really go away. I had the same problem with Avast. First thing you might want to do is delete Avast and then immediately install another security system. I have Malwarebytes now and like it much better.