About 30-50% of the times I run tails in a vm my avast pops up a notice on the host complaining about some problem with a certificate. The sites, however, do not seem to exist and the url looks more or less random. This never happens when I start another vm or during my normal PC usage only when I use tails(and then also not in each case). Imho this looks quite fishy. I'm wondering how it is even possible for avast to somehow analyse the traffic from the vm. Attached is an image of the report.
The Tor client uses TLS to encrypt connections between clients and relays, as well as between relays. TLS was selected primarily because it is standardised, well analysed and offers reasonable security. An added benefit however is that TLS is used in HTTPS for encrypted web browsing so Tor traffic is tricky to distinguish from HTTPS. While many networks might be happy to censor Tor traffic, they will think twice before blocking all HTTPS. For this reason, Tor's use of TLS tries to emulate HTTPS web browsing.
Just like HTTPS web servers, Tor relays need to provide a certificate. For websites this certificate would contain the site's domain name and will be generally signed by a commercial certification authority (CA), who will charge for signing this certificate. Tor relays however might not have a domain name, and there is no need for a CA to sign the certificate because the Tor directory authorities already sign the relays' public keys which in turn sign the public key in the TLS certificate.
So Tor relays generate a certificate for a random domain name (to see how, look at the code in
crypto_random_hostname). This domain name will be visible to anyone scanning your network traffic (it is not encrypted), and it looks like this is what Avast is doing. You are seeing a strange domain name for the certificate and because the certificate is not signed by any CA which Avast knows about, you are getting a warning message. Avast will not however be able to look inside the encrypted traffic because it does not have access to the keys of the web browser in the VM.
So although it looks fishy, this is just your Tor client communicating as normal. Avast is confusing Tor traffic with HTTPS, but that is exactly what Tor is trying to do. HTTPS traffic where the server certificate is not signed by a well-known CA may be indicative of a man in the middle attack, but it is perfectly OK for Tor traffic to not be signed by any CA. I don't know enough about Avast to suggest how to disable this behaviour, but it is safe to ignore it.