SSL/TLS inspection
termsecuritynetworking
An organisation terminating and re-encrypting its own users' encrypted sessions in order to inspect the contents, using a certificate authority it installs on every managed device.
Technically it is a man-in-the-middle performed with the organisation's consent rather than the individual user's, and every property of that position applies: the device holds the plaintext of every session it inspects and a private key that every managed device trusts, which makes it the most valuable single object on the network. National security guidance has been explicit that the inspection point becomes a high-value target and that breaking end-to-end protection introduces risks to be weighed against the visibility gained. Three practical frictions recur. Pinned applications fail rather than degrade, so an exception list is unavoidable. Certificate errors that would have warned a user about a genuine attack are now generated and resolved by the appliance, so the user sees nothing either way. And the shift towards encrypting the handshake itself, including the name of the site being visited, is progressively removing the metadata that name-based policy depends on.
Also known as: ssl inspection, tls inspection, https inspection, break and inspect, ssl decryption