I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic.
It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of the traffic the firewall uses his own certificate --> Why?
Wouldn't it be easier to copy the encrypted traffic, decrypt it, scan it and send the (still encrypted) copy of the traffic to the client? Or is this impossible?
I ask this question, because if I use a self-signed certificate for the re-encryption. The browser would display a security warning. I don't want to add the certificate to the client, because I have to give the certificate every visitor in our network.