TLS decryption, also called HTTPS inspection, has a middlebox break an encrypted connection in two so it can read the traffic. It helps find malware and data leaks. It also adds a point of failure: if the middlebox validates certificates badly, your users lose the protection TLS was meant to give.
How does TLS decryption work?
TLS creates an encrypted channel between a client and a server, and uses certificates to prove the server is who it claims to be. RFC 8446, the TLS 1.3 specification, says the primary goal of TLS is a secure channel between two communicating peers, with authentication, confidentiality and integrity.
An inspection product acts as a deliberate man-in-the-middle. CISA's alert TA17-075A describes it plainly. The product intercepts the connection and performs what is technically a man-in-the-middle attack. To avoid warnings, administrators install the product's certificate as trusted on client devices. The client then talks encrypted to the product, and the product talks encrypted to the real server.
Everything depends on that second leg. The client can only verify its connection to the middlebox. As CISA puts it, clients must rely on the validation the product performs.
What can go wrong?
CISA's alert, based on research it cites, found that many inspection products did not properly verify the server's certificate chain before re-encrypting and forwarding data, and rarely passed verification errors back to the user. A user believes they reached the correct server when they did not. The same applies to protocol versions and ciphers: the middlebox may accept deprecated versions or weak ciphers from a server, while the browser still shows a strong connection to the middlebox.
Other practical risks follow from the design:
- The middlebox holds the private key of a certificate your devices trust for everything. If it is stolen, whoever has it can impersonate any site to your users.
- Decrypted traffic may be logged, which creates a store of passwords, health data and banking sessions.
- Some applications pin certificates and will break. Teams then add broad exceptions, which weakens coverage.
- Privacy law and employee expectations may limit what you may inspect.
CISA's advice is to carry out a risk assessment, decide whether inspection is truly required, and then confirm the product validates certificates and passes errors to the client.
How do you test an inspection product?
CISA points to badssl.com, a public site with deliberately bad certificates, such as expired or self-signed ones. If a client with direct internet access refuses to connect to a test page, the same client should also refuse it through the inspection product. If the product lets it through, it is hiding errors from your users.
A constructed example: a company turns on inspection for all traffic. A tester loads a page with an expired certificate from a laptop on the office network and from a phone on mobile data. The phone shows a full-page warning. The laptop loads the page quietly. That gap is the defect to fix before go-live.
Where is decryption worth it?
Scope it. Inspect categories where the benefit is clear, such as uncategorized sites and file downloads, and exempt categories where the risk is greater than the gain, such as banking, healthcare and password managers. Keep endpoint protection in place too, since some threats are visible on the device after the connection is decrypted.
How to check or apply this
- Write down the specific threats you expect inspection to catch. If you cannot name any, reconsider.
- Run the badssl.com certificate tests through the product and compare with direct access.
- Check which protocol versions and ciphers it accepts toward servers, and restrict them to current ones.
- Store the interception certificate key in hardware or a managed key store, and limit who can use it.
- Create exemption categories for sensitive sites and document them.
- Decide how long decrypted logs are kept, who can read them, and publish the policy to staff.
- Review the setup after every major product update.
Quick check
Does TLS decryption weaken encryption?
It can. The client trusts the middlebox instead of verifying the server directly, so any weakness in the middlebox's certificate checks becomes a weakness for every user behind it.
How do you test whether an inspection product validates certificates?
Visit the certificate test pages on badssl.com directly and through the product. If a page is blocked directly but loads through the product, the product is not passing errors on.
Sources
- CISA, Alert TA17-075A: HTTPS Interception Weakens TLS Security
- RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3
Last reviewed: 18 October 2026.
