I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP.
Updating them is unworkable due to legacy issues and hardware requirements for a proper TLS implementation.
The only point where I can force force encryption is the WAN <-> LAN gateway using a TLS proxy with some help from the firewall.
What are the security risks of this solution?