# What Is SSL Inspection? Definition and Examples

> SSL inspection is the practice of a security gateway decrypting, inspecting and re-encrypting TLS traffic, using a private CA trusted on managed devices.

Source: https://ssl.sh/glossary/ssl-inspection/
Last updated: 2026-11-10

SSL inspection, also called TLS or HTTPS inspection or break-and-inspect, is deployed by organizations on next-generation firewalls, secure web gateways and data loss prevention systems. When a managed device connects to `https://example.com`, the gateway terminates the connection, generates a certificate for `example.com` on the fly signed by an internal [private CA](https://ssl.sh/glossary/private-ca/), connects to the real server itself, and relays the traffic while scanning it for malware, policy violations or data leaks. It works only because the organization's root certificate is installed in the devices' [trust stores](https://ssl.sh/glossary/trust-store/): it is a deliberate, authorized [man-in-the-middle](https://ssl.sh/glossary/man-in-the-middle/).

## Why it matters
Without inspection, a gateway sees little more than the hostname, so encrypted malware downloads and data exfiltration can go unnoticed. The costs are real, though. The gateway now validates server certificates on users' behalf, and one with weak validation or outdated protocol support lowers security for everyone behind it. Applications that use [certificate pinning](https://ssl.sh/glossary/certificate-pinning/) or mutual TLS break, and tools with their own trust stores, such as Python, Java, Node.js, Git and curl, report errors like "self-signed certificate in certificate chain" until the corporate root is added to them. Most deployments exempt sensitive categories such as banking and healthcare, and organizations typically inform users through an acceptable-use policy.

## Example
Check who actually issued the certificate a device receives:

```bash
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer
# issuer=... CN = Example Corp Inspection CA   <- traffic is being inspected
```

Give developer tools the corporate root instead of disabling verification:

```bash
export NODE_EXTRA_CA_CERTS=/etc/ssl/corp-root.pem        # Node.js
export REQUESTS_CA_BUNDLE=/etc/ssl/corp-ca-bundle.pem     # Python requests (full bundle)
git config --global http.sslCAInfo /etc/ssl/corp-ca-bundle.pem
```

## Common misconceptions
- **Inspection is undetectable.** The certificate issuer reveals it, and pinned apps fail visibly.
- **A gateway can inspect any device on the network.** Only devices that trust the organization's root; other devices get certificate errors.
- **Turning off certificate verification in tools is the fix.** Add the corporate root to the tool's trust store instead; disabling verification exposes the tool to real attackers.

## Related terms

- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。
- [私有 CA](https://ssl.sh/zh/glossary/private-ca/): 私有 CA 是企业为自己的系统和设备搭建的证书颁发机构，其根证书只在企业主动安装的设备上受信任。
- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [证书锁定](https://ssl.sh/zh/glossary/certificate-pinning/): 证书锁定是客户端侧的一项检查：只有服务器证书链中包含事先配置好的特定证书或公钥时，客户端才接受这次连接。
- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [TLS 终止](https://ssl.sh/zh/glossary/tls-termination/): TLS 终止是指网络路径上客户端 TLS 连接结束并被解密的位置，可以是 CDN 边缘、负载均衡、反向代理，也可以是应用服务器本身。