What TLS inspection actually sees
Open a connection to a hostname, with inspection off and then on, and watch what a device on the path can read at each stage. One of the three things people assume HTTPS hides isn't hidden in either state. Everything is simulated in this tab: no connection is opened, no name is resolved, nothing is sent anywhere.
Four words this lab uses, in case any of them are new. Skip if not.
- SNI — Server Name Indication. A field in the first message of a TLS handshake that says which hostname you want. The server needs it to know which certificate to present, so it is sent before there is any encryption to hide it in.
- Terminate — a device that terminates TLS is one end of the encrypted session rather than something the session passes through. It has the keys because it negotiated them. An inspecting proxy terminates your session and opens a second one of its own.
- Trust store — the list of certificate authorities your device already believes. Public ones ship with the operating system and the browser. A private one has to be installed, which is what makes inspection possible without a warning on every page.
- ECH — Encrypted Client Hello. The mechanism that encrypts the SNI. It is a published standard now (RFC 9849, March 2026); whether it is actually on for a given connection is a different question, covered below.
Flip the toggle and re-run to compare. The addresses come from the ranges reserved for documentation, the internal CA is invented, and the request and response are mock-ups. A browser tab has no way to watch its own handshake, so this one is drawn from the RFCs rather than captured. For a real one, use Wireshark or the certificate viewer behind your padlock.
The caveats
Where this comes from
Protocol behavior, not any vendor's implementation. Terminating and re-signing is how every inspecting proxy has to work. There is no way to read the inside of a TLS session without being one end of it.
Related
The PAC file tester covers the other half of this: deciding which traffic goes to a proxy in the first place. If you want to see which rule actually fired on a real connection, the net-export post walks through reading the log.
get the PAC cheat sheet
One page: the debugging order, the classic mistakes, the pattern gotchas, and the client behavior that catches people out. Confirm your email and it's yours straight away — plus a note when a new tool lands.
ack — check your inbox for a confirmation link.
One confirmation email, then you're in. Unsubscribe anytime.