HTTPS Proxy Content Inspection [closed]

Question

Is it possible for a proxy server to do content inspection on HTTPS traffic?

Answer 1

When using a proxy to inspect HTTPS traffic, the communication looks like this:

client <===HTTPS===> proxy <===HTTPS===> server
             ^                   ^
    proxy certificate     server certificate

While the traffic over the wire is always encrypted, communication between the client and the proxy uses a certificate generated and signed by the proxy. This means the proxy is able to decrypt and inspect the web traffic.

Since this certificate is self-signed, the client would receive an SSL warning message looking something like this. Once the client installs the proxy's certificate to let the browser trust the certificate, browsing websites with HTTPS will look normal and have the green padlock in the URL bar.

Anyone intercepting this traffic between the client and the proxy still can't read its contents since it is encrypted. Communication between the proxy and the server is also fully encrypted using the server's certificate.

Answer 2

Yes it is possible, but for HTTPS you will need  to install to your clients, the CA proxy's certificate, otherwise the proxy will be able to inspecting just the HTTP traffic and other protocols that not use the TLS protocol.