# Can HTTPS traffic be intercepted by a man in the middle?

Only if the client can be made to trust the interceptor. A man-in-the-middle attack on HTTPS needs a certificate the client accepts for the target name, a user who clicks through the warning, or an application that does not check certificates properly. Companies do it on purpose with TLS inspection proxies, by installing their own root certificate on managed devices. Attackers try the same by planting a rogue root certificate through malware, by getting users to accept warnings, or by exploiting apps with broken certificate checks. Defences: never train staff to click through certificate warnings, control which root certificates are installed on company devices, keep apps updated, and use HTTP Strict Transport Security (HSTS) on your own websites so browsers refuse plain connections. Certificate pinning in some apps refuses any interceptor, including your own proxy. In TLS 1.3 the server certificate is encrypted, so a passive network sensor cannot check who issued it; that check belongs on the device or in proxy logs.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/can-https-traffic-be-intercepted

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is JA4 TLS fingerprinting?](https://netsenx.com/en/faq/what-is-ja4-tls-fingerprinting)
- [What is the difference between JA3 and JA4?](https://netsenx.com/en/faq/what-is-the-difference-between-ja3-and-ja4)
- [What is SNI, and why does it matter for monitoring?](https://netsenx.com/en/faq/what-is-sni-and-why-does-it-matter-for-monitoring)
- [What is Encrypted Client Hello (ECH)?](https://netsenx.com/en/faq/what-is-encrypted-client-hello)
- [Does Encrypted Client Hello blind network monitoring?](https://netsenx.com/en/faq/does-encrypted-client-hello-blind-network-monitoring)