My organisation is concerned about viruses and attacks coming into our network.
Since http traffic has been declared persona non grata by some browser makers and other parties, it becomes increasingly difficult to perform such function.
As many sites nowadays block
http:// access (instead simply redirecting to their
https:// version), we're forced to do MitM to continue our scans effectively.
Which means that we must perform certificate authentication on a central basis, since it'll be our proxy that'll be doing the client-side TLS.
Not desiring to block self-signed certs of third parties, in such MitM setup, is there anything we can do to ensure our users can distinguish between downstream websites with self-signed and CA-based certificates? E.g., if our upstream themselves does a MitM on our traffic, is there a way for us to let our user know, without blocking the connection (e.g., let them decide)?