i would like to know if i encrypt a proxy server communication with TLS v1.3 is it still possible for a firewall censor to a deep packet scanning to decrypt. Also, what can be done to make the encrypted proxy more secure?

1 Answer 1


Encrypting alone will not help. You have to make sure that the encryption is actually done end-to-end to the expected proxy and not via some man in the middle, like the intercepting proxy on the firewall. Thus you not only need to enable TLS but also make sure that you properly check the certificate against the expected one.

Since in corporate environments it is pretty common that the intercepting proxy is added as trust anchor on all machines it is not sufficient to just rely on checking if the certificate is trusted, but also you need to make sure that it is exactly the certificate you expected or that it was issued by the CA you expect. Alternatively you might setup the proxy so that it requires authentication with client certificates which makes SSL interception impossible too, assuming that the proxy properly checks the client certificate. How this is done and if this can be done at all in your environments depends on your specific (unknown) setup.

Once this is done the connection to the proxy is save against SSL interception in the middle. You still have to trust the proxy itself though. TLS will also not protect against interception before encryption and after decryption, for example from within a browser extension.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .