This question already has an answer here:

Like many people I work within a company that deals with internet access of its employees by providing a proxy server.

Although i got the idea that a https session encrypts, from peer to peer, all the traffic between my browser and the server at the end, I have been told by one of our sysadmin that all my https connections are somehow « deconstructed » or « unravelled » by the corporate ssl proxy. And, by this way, consequently, my employer could easily see and read all my web access including all my https sessions.

Is it true? °_°

marked as duplicate by Steffen Ullrich tls Nov 13 '16 at 17:53

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


While I can't say if it it is exactly true in your situation, it is definitely possible and probably likely given your IT guy said it is.

A guess would be all machines in your network have a trusted certificate installed that allows your corporate proxy to MitM your TLS connections. Essentially, you are connecting to the proxy securely and since you trust the proxy's certificate it doesn't alert you. The proxy then connects to the outside normally.

Reasons this is useful to the company are substantial. They can now be aware of ALL traffic passing through their network and it makes it easier to spot malicious activity. That or otherwise unauthorized activity (porn, drugs, etc.).

This question comes up a lot in regards to privacy. Just remember the company OWNS the network. Don't browse personally on it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.