Issue
- ESET Windows endpoint applications with TLS filtering enabled cannot connect to an intranet or localhost site using HTTPS
- You are asked for the password repeatedly, but the credentials are rejected
- Single sign-on does not work with TLS filtering enabled in ESET endpoint applications when accessing intranet sites using HTTPS
- Credentials must be entered manually using an HTML form
- Create an exception on the affected computers to resolve the issue
- Disable the "Extended Protection for Authentication" feature on the server
Details
Click to expand
This situation can occur if the authentication is based on protocols such as SPNEGO (WWW-Authenticate: Negotiate), Kerberos, and NTLM, and if Channel Binding Tokens are used.
This behavior is a security feature of the underlying authentication protocol.
Solution
Create an exception on the affected computers to resolve the issue
-
Open the main program window of your ESET Windows application.
-
Press the F5 key to access Advanced setup.
-
Click Protections → SSL/TLS → Edit (next to Certificate rules).
-
Click Add.
-
Click URL, and type the server's domain name in the URL address field. Click OK.
-
Next to Scan action, select Ignore, then click OK.
-
Click OK → OK to confirm the configuration change.
If you manage ESET endpoint applications remotely using ESET PROTECT, apply these settings as a policy.
Disable the "Extended Protection for Authentication" feature on the server
Disabling this feature will leave your server vulnerable to Man in the Middle attacks and is not recommended. We recommend that you attempt the solution above.
For more information, see:
- Best Practices for Secure Planning and Deployment of AD FS—Utilize extended protection for authentication
- Channel binding token
