This question already has an answer here:
I heard once from someone I trust, that the French governement is about to buy and certify a software to put on tap an internet line even for HTTPS connection. I don't really care about the legal issues it brings because this product will be use anyway by law enforcment, but I'm quite interested in how it is possible.
In the case of HTTPS for example how a software on the provider level can decrypt your connection between you and a server without breaking some security of the HTTPS protocol like the fact that the certificate used for this connection is not valid? Or having no more HTTPS connection to any website (something I will notice for sure and any cautious person would to).
Did you ever heard of such a software or appliance (I don't know how it works at all)? And if you do so, do you know how it works ?
Edit 1: Well maybe some of you misunderstand my question, I'm not asking if the MITM is possible with SSL or not because I know it is, as long as you manage one of the trust authority, which can be the case in a company for several reasons (I work on that once).
The point here is to put you Internet line on tap and being able to read any information you receive. This is not a problem on http/ftp/and other not encrypted protocol
But my question is more on the encrypted protocol with trust authority like SSL/TLS and the ISP point of view, is it doable or not? ISP do not own trust authority in most case and they can't fake every certificate on the fly.
In my understanding of the SSL protocol that would mean to also hack into the tapped computer to add to it a fake trust authority, but that doesn't sound either legal nor realistic with the multiplication of device.
Again the person who told me that is someone I trust and I'm really curious about the truth of that statement.
One idea for example:
the ISP setting a DNS Poisonning on the internet line to redirect any trust authority request to it's own authority , does it sounds possible to you ?
PS: I'm not working for anything I don't support those kind of solution but I'm really curious about how it's even possible.