Firewalls, proxies, and secure web gateways terminate the TLS connection from the client, inspect the plaintext for malware, data exfiltration, or policy violations, then open a second TLS session to the destination. The middlebox effectively acts as an authorized man-in-the-middle, which requires its certificate authority to be trusted by managed devices.
Key points
Inspection scopeDefine categories and destinations to inspect or bypass — finance and health traffic, certificate-pinned applications, and legally sensitive flows may warrant exclusion.
Trust-chain managementClients must trust the inspection CA; unmanaged devices, pinning, and certificate transparency all resist or expose interception.
Important limitationInspection breaks end-to-end guarantees by design. It centralizes decrypted traffic and the CA key on the middlebox, can weaken or misreport certificate validation, can hide some attacks that cannot be decrypted anyway, and carries privacy and legal obligations that need explicit policy.