I am doing a penetration test at the moment, where the client has deep packet inspection for SSL enabled (my guess), as every SSL connection seems to being MITMed.
Now, some HTTPS sites, like Gmail, throw up a warning about the site not being trusted. Which is expected. Other sites however, such as Yahoo Mail, are not being MITMed, as the certificate shows that it belongs to Yahoo and signed by VeriSign.
So, does this mean only particular sites are chosen to intercept (which would be very odd given the mix of sites that give a warning and ones that do not), or that there is a way to fool the browser?
I'm thinking the former, but don't want to rule out the latter in case there is something I'm not aware of.