# What is TLS Inspection?

> TLS inspection is the deliberate decryption and re-encryption of TLS traffic at a trusted middlebox so security controls can see inside encrypted sessions.

- Canonical URL: https://yellowcube.eu/glossary/transport-layer-security-inspection/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Firewalls, proxies, and secure web gateways terminate the TLS connection from the client, inspect the plaintext for malware, data exfiltration, or policy violations, then open a second TLS session to the destination. The middlebox effectively acts as an authorized man-in-the-middle, which requires its certificate authority to be trusted by managed devices.

### Key points

- **Inspection scope:** Define categories and destinations to inspect or bypass — finance and health traffic, certificate-pinned applications, and legally sensitive flows may warrant exclusion.
- **Trust-chain management:** Clients must trust the inspection CA; unmanaged devices, pinning, and certificate transparency all resist or expose interception.
- **Important limitation:** Inspection breaks end-to-end guarantees by design. It centralizes decrypted traffic and the CA key on the middlebox, can weaken or misreport certificate validation, can hide some attacks that cannot be decrypted anyway, and carries privacy and legal obligations that need explicit policy.

### Related terms

[Deep packet inspection (DPI)](<https://yellowcube.eu/glossary/deep-packet-inspection/>) · [Next-generation firewall (NGFW)](<https://yellowcube.eu/glossary/next-generation-firewall/>) · [Secure web gateway (SWG)](<https://yellowcube.eu/glossary/secure-web-gateway/>) · [Proxy server](<https://yellowcube.eu/glossary/proxy-server/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [Transport Layer Security (TLS)](<https://yellowcube.eu/glossary/transport-layer-security/>)

### Sources

[NIST SP 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations](https://csrc.nist.gov/pubs/sp/800/52/r2/final) · [NSA, Managing Risk from Transport Layer Security Inspection](https://www.nsa.gov/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.