* * deny — ~/lab/tls-inspection

What TLS inspection actually sees

Open a connection to a hostname, with inspection off and then on, and watch what a device on the path can read at each stage. One of the three things people assume HTTPS hides isn't hidden in either state. Everything is simulated in this tab: no connection is opened, no name is resolved, nothing is sent anywhere.

terms, quickly

Four words this lab uses, in case any of them are new. Skip if not.

  • SNI — Server Name Indication. A field in the first message of a TLS handshake that says which hostname you want. The server needs it to know which certificate to present, so it is sent before there is any encryption to hide it in.
  • Terminate — a device that terminates TLS is one end of the encrypted session rather than something the session passes through. It has the keys because it negotiated them. An inspecting proxy terminates your session and opens a second one of its own.
  • Trust store — the list of certificate authorities your device already believes. Public ones ship with the operating system and the browser. A private one has to be installed, which is what makes inspection possible without a warning on every page.
  • ECH — Encrypted Client Hello. The mechanism that encrypts the SNI. It is a published standard now (RFC 9849, March 2026); whether it is actually on for a given connection is a different question, covered below.
inspection

Flip the toggle and re-run to compare. The addresses come from the ranges reserved for documentation, the internal CA is invented, and the request and response are mock-ups. A browser tab has no way to watch its own handshake, so this one is drawn from the RFCs rather than captured. For a real one, use Wireshark or the certificate viewer behind your padlock.

The caveats

Where this comes from

Protocol behavior, not any vendor's implementation. Terminating and re-signing is how every inspecting proxy has to work. There is no way to read the inside of a TLS session without being one end of it.

Related

The PAC file tester covers the other half of this: deciding which traffic goes to a proxy in the first place. If you want to see which rule actually fired on a real connection, the net-export post walks through reading the log.