How is data decryption handled with proxy devices in perimeter networks (DMZ) in companies? Let's assume we host hundreds of web sites on our DMZ servers, how can we get the data decrypted or even first authenticate the server to the external client connecting from Internet ? I cannot imagine that Symantec , GoDady etc. would provide us with a Root CA for our proxy device for certificate resign, so how can a proxy by used in such cases ?
The CA will not provide you with a certificate for a proxy. They will also not provide you with a certificate for a specific server. They will just provide you with a certificate matching a specific hostname (or multiple names). Where you use this certificate is up to you (some CA might restrict this). You might even use the same certificate on multiple system.
This means for your case that you could use the same certificate both on the proxy and on the final server, i.e. terminating the TLS traffic at the proxy and then having another TLS connection with the same certificate to the real server. But you could also terminate the TLS traffic at the proxy with the certificate issued by the public CA and then use a different certificate for the real server by using your own PKI which is trusted by your proxy. Or, if the connection to the real server from the proxy is considered protected by other means (like IPSec) you could also use plain traffic without TLS to connect from the proxy to the real server.
By terminating the TLS connection in the proxy the proxy has access to the plain text and can also make changes to the traffic, like requesting authentication, filtering traffic in a WAF etc.