-1

Is it possible for a proxy server to do content inspection on HTTPS traffic?

  • What you described is called TLS/SSL transparent proxy. – game0ver Mar 25 '18 at 12:21
4

When using a proxy to inspect HTTPS traffic, the communication looks like this:

client <===HTTPS===> proxy <===HTTPS===> server
             ^                   ^
    proxy certificate     server certificate

While the traffic over the wire is always encrypted, communication between the client and the proxy uses a certificate generated and signed by the proxy. This means the proxy is able to decrypt and inspect the web traffic.

Since this certificate is self-signed, the client would receive an SSL warning message looking something like this. Once the client installs the proxy's certificate to let the browser trust the certificate, browsing websites with HTTPS will look normal and have the green padlock in the URL bar.

Anyone intercepting this traffic between the client and the proxy still can't read its contents since it is encrypted. Communication between the proxy and the server is also fully encrypted using the server's certificate.

| improve this answer | |
1

Yes it is possible, but for HTTPS you will need  to install to your clients, the CA proxy's certificate, otherwise the proxy will be able to inspecting just the HTTP traffic and other protocols that not use the TLS protocol.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.