What does TLS inspection on a firewall break?

More than people expect. To inspect HTTPS, the firewall or proxy ends each connection, decrypts it, inspects it and opens a new encrypted connection to the real server, presenting its own certificate signed by a company root installed on every managed device. The side effects: apps with certificate pinning, many updaters, some banking and health apps and parts of cloud services refuse the substitute certificate, so exception lists keep growing; unmanaged devices, guests and machines cannot be inspected at all; the proxy becomes one place that holds decrypted traffic, including personal data, which raises GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). and works-council questions; older proxies may not support recent TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. features or the new hybrid post-quantum groups and quietly weaken connections; and inspection costs performance. It still has its place, for example scanning downloads on managed laptops. But many threats are visible without it. NetSenX takes that approach: it never decrypts and works from metadata and the unencrypted handshake.

← All 40 questions on Encryption and encrypted trafficAll topics