This question already has an answer here:

A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device.

If it is capable of doing this, ISPs, Governments or whoever can read HTTPS traffic, right?

That's my first concern. The second one is how firewalls can do that? As it's not required to install any certificate from the device on a PC.

marked as duplicate by Ben, dave_thompson_085, Steffen Ullrich, Community May 29 at 12:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    So much to unpack here. I encourage you to confirm some of these assumptions before asking questions based on them. Just because your local firewall can inspect traffic does not mean any node on the network can (like ISPs). To inspect the traffic, yes, the client needs to install a certificate. Please explain the situation where you do not have to install a certificate to break SSL. – schroeder May 28 at 21:53
  • The most the device can do without you installing its root CA cert is to look at SNI to get domain name and look at flow to esitimate response size and timing. This way it is possible to guess client is downloading particular file, reading particular wikipedia article, watching particular movie on netflix. For well known content the inspection device "knows" (possibly using cloud database). – Z.T. May 28 at 22:16

The point of a firewall is that it creates a boundary between internal and external. Traffic going through the firewall passes from internal to external. So for all intents and purposes, consider the firewall to be wholly internal except for the 2-dimensional plane that is public-facing; in other words, the network is internal including the firewall up to and excluding the firewall’s doors.

As a result, everything authoritative the firewall does with regard to the network (and again, I’m simplifying) is within that internal boundary. And we can assume the internal network operates at a high trust level such that privileged entities within the boundary (such as a firewall) can see and control certain aspects of traffic without breaking CIA.

The threat actors you’re describing here (governments and so on) are external. Outside of the network, nothing can be more privileged than anything else. So to answer your question, as far as at least the civilian population is aware, no, it’s not possible for external parties to interact with public traffic as though it were a firewall.

Does that make sense? Comment if you have any other questions. I think there might be some core concepts here that would be good to research and review, including network fundamentals and how HTTPS works.

Not the answer you're looking for? Browse other questions tagged or ask your own question.