Why does an ad blocker need a certificate?
Because nearly every ad arrives inside an encrypted HTTPS connection. A blocker that filters every browser from outside them can see which site a connection goes to, but not what is in it. To remove an individual ad or tracker from a secure page, it has to read the page, and browsers only accept a page it has filtered if it is vouched for by a certificate they trust. So the blocker installs one on your PC.
How does AdFender handle secure pages?
With four safeguards, each of which you can check:
- A certificate unique to your PC. AdFender creates its private root certificate on your PC when you turn HTTPS filtering on, during setup or later from the dashboard. No two installations share one, so a key taken from one PC is useless against any other.
- A key that never leaves your PC. We never see it and do not hold a copy. The certificates for the sites you visit are made on your PC, from that key, as you visit them. On an Install for all users of this computer setup, every Windows account on the PC can use it.
- Sensitive sites left alone. Several hundred banking, payment, password-manager, government and tax sites are on AdFender’s exclusion list from the start, and their traffic passes through without being decrypted. You can add your own.
- Yours to remove. Turning HTTPS filtering off offers to take the certificate out of Windows, and the uninstaller asks whether to remove it.
What encryption does AdFender use?
Only current encryption. When AdFender connects to a website for you, it uses TLS 1.3 or TLS 1.2, with forward secrecy on every connection and no outdated cipher suites. Your pages are read and filtered on your PC and are never sent to us.
How can you check it yourself?
- On the dashboard, open HTTPS filtering. It shows who issued the certificate, when it expires and its SHA-256 fingerprint. On another PC with AdFender the fingerprint is different, so you can see that the two installations use different certificates.
- In Windows, search the Start menu for Manage computer certificates and open Trusted Root Certification Authorities: the AdFender certificate is listed there under its name.
- Test the encryption with an independent browser test such as the SSL Labs client test. With AdFender running and HTTPS filtering on, it reports only modern, forward-secret suites.
Can you use AdFender without HTTPS filtering?
Yes. AdFender keeps working with it off, but catches much less: it can still refuse a connection to a known ad server by name, without decrypting anything, but cannot remove ads from inside secure pages. Choose Not now when setup asks, and you can turn it on later from HTTPS filtering on the dashboard. HTTPS filtering and the certificate shows how to turn it off, renew the certificate, and manage the exclusion list. What AdFender sends us is listed in full in our privacy policy.