I have a Sophos XG firewall. I use it at home (to play around with) This firewall is capable to scan HTTPS traffic.

It decrypts the traffic and re-encrypts the traffic again. For the re-encryption of the traffic the firewall uses his own certificate --> Why?

Wouldn't it be easier to copy the encrypted traffic, decrypt it, scan it and send the (still encrypted) copy of the traffic to the client? Or is this impossible?

I ask this question, because if I use a self-signed certificate for the re-encryption. The browser would display a security warning. I don't want to add the certificate to the client, because I have to give the certificate every visitor in our network.

1 Answer 1


How could the firewall decrypt the traffic encrypted by a key protected by the end website? If that was possible, then encryption would be meaningless.

TLS Interception

TLS inspection requires that the firewall has the traffic unencrypted. Users use the firewall certificate to encrypt the traffic (so it's protected even in the local network) then the firewall uses its own certificate to decrypt the traffic for inspection. Then it uses the end website's certificate to re-encrypt and sends the traffic on.


You have a bigger problem if you want to use TLS interception with visitors. Inspecting visitor traffic breaks a bunch of privacy laws. You should not be inspecting visitor traffic unless you have their permission and they are properly informed (especially in Europe, but also in other jurisdictions).

As part of that "informing" process, you could provide your firewall's certificate, or you could do the much easier thing: provide a visitor wifi network without these controls.

At Home and Playing Around

TLS interception is meant for corporate environments. The Sophos XG firewall is an enterprise firewall, so many of its functions are not designed for home use. So, if you want to play around with it, that's great, but you have to keep its intended use case in mind when you are inconvenienced by using its functions at home.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.