中文

Glossary

SSL Inspection (TLS inspection, HTTPS inspection)

Last verified

Definition

SSL inspection is the practice of a security gateway decrypting, inspecting and re-encrypting TLS traffic, using a private CA trusted on managed devices.

SSL inspection, also called TLS or HTTPS inspection or break-and-inspect, is deployed by organizations on next-generation firewalls, secure web gateways and data loss prevention systems. When a managed device connects to https://example.com, the gateway terminates the connection, generates a certificate for example.com on the fly signed by an internal private CA, connects to the real server itself, and relays the traffic while scanning it for malware, policy violations or data leaks. It works only because the organization's root certificate is installed in the devices' trust stores: it is a deliberate, authorized man-in-the-middle.

Why it matters

Without inspection, a gateway sees little more than the hostname, so encrypted malware downloads and data exfiltration can go unnoticed. The costs are real, though. The gateway now validates server certificates on users' behalf, and one with weak validation or outdated protocol support lowers security for everyone behind it. Applications that use certificate pinning or mutual TLS break, and tools with their own trust stores, such as Python, Java, Node.js, Git and curl, report errors like "self-signed certificate in certificate chain" until the corporate root is added to them. Most deployments exempt sensitive categories such as banking and healthcare, and organizations typically inform users through an acceptable-use policy.

Example

Check who actually issued the certificate a device receives:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer
# issuer=... CN = Example Corp Inspection CA   <- traffic is being inspected

Give developer tools the corporate root instead of disabling verification:

export NODE_EXTRA_CA_CERTS=/etc/ssl/corp-root.pem        # Node.js
export REQUESTS_CA_BUNDLE=/etc/ssl/corp-ca-bundle.pem     # Python requests (full bundle)
git config --global http.sslCAInfo /etc/ssl/corp-ca-bundle.pem

Common misconceptions

  • Inspection is undetectable. The certificate issuer reveals it, and pinned apps fail visibly.
  • A gateway can inspect any device on the network. Only devices that trust the organization's root; other devices get certificate errors.
  • Turning off certificate verification in tools is the fix. Add the corporate root to the tool's trust store instead; disabling verification exposes the tool to real attackers.

See also