Can HTTPS traffic be intercepted by a man in the middle?

Only if the client can be made to trust the interceptor. A man-in-the-middle attack on HTTPS needs a certificate the client accepts for the target name, a user who clicks through the warning, or an application that does not check certificates properly. Companies do it on purpose with TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. inspection proxies, by installing their own root certificate on managed devices. Attackers try the same by planting a rogue root certificate through malware, by getting users to accept warnings, or by exploiting apps with broken certificate checks. Defences: never train staff to click through certificate warnings, control which root certificates are installed on company devices, keep apps updated, and use HTTP Strict Transport Security (HSTS) on your own websites so browsers refuse plain connections. Certificate pinning in some apps refuses any interceptor, including your own proxy. In TLS 1.3 the server certificate is encrypted, so a passive network sensor cannot check who issued it; that check belongs on the device or in proxy logs.

← All 40 questions on Encryption and encrypted trafficAll topics