Is it possible for a proxy server to do content inspection on HTTPS traffic?
When using a proxy to inspect HTTPS traffic, the communication looks like this:
client <===HTTPS===> proxy <===HTTPS===> server ^ ^ proxy certificate server certificate
While the traffic over the wire is always encrypted, communication between the client and the proxy uses a certificate generated and signed by the proxy. This means the proxy is able to decrypt and inspect the web traffic.
Since this certificate is self-signed, the client would receive an SSL warning message looking something like this. Once the client installs the proxy's certificate to let the browser trust the certificate, browsing websites with HTTPS will look normal and have the green padlock in the URL bar.
Anyone intercepting this traffic between the client and the proxy still can't read its contents since it is encrypted. Communication between the proxy and the server is also fully encrypted using the server's certificate.