SSL Proxy and MITM Detection

Check whether something on your network is intercepting and re-encrypting your HTTPS traffic. An SSL proxy terminates your encrypted connection, inspects the contents, then opens a second connection to the real destination — so the padlock still appears while a third party reads everything inside.

How interception is detected

The test compares the certificate your connection actually received against the one the destination genuinely presents. Interception cannot forge a certificate that chains to a public root, so a proxy substitutes one signed by its own certificate authority — which has to be installed on your device for the connection to work at all.

An unexpected issuer is therefore strong evidence, and worth acting on. Confirm what it is before concluding who is responsible: antivirus and parental-control software installed on your own machine inspect traffic exactly the same way, and a captive portal can substitute a certificate before you have authenticated.

Where this is normal and where it is not

On a corporate laptop, interception is usually deliberate, disclosed in an acceptable-use policy, and performed to enforce data-loss prevention or malware scanning. It is not an attack, though it does mean everything you do on that device is readable by your employer.

On a network you do not control — a hotel, an airport, a cafe, someone else's Wi-Fi — the same result deserves a different reaction. If you cannot account for why interception is happening, stop using the network for anything that matters.

The limits of a negative result

A clean result is weaker evidence than a positive one. Checking a single destination cannot rule out selective interception, where a proxy inspects some categories of traffic and passes others through untouched — banking and health sites are frequently exempted precisely to avoid liability.

Applications using certificate pinning also refuse a substituted certificate outright rather than reporting one. Most mobile banking apps behave this way, so an app that simply fails to connect on a network where browsing works normally is itself a signal worth noticing.

What you can do about it

On a managed device your employer owns, essentially nothing — and attempting to circumvent monitoring on corporate equipment is usually a disciplinary matter rather than a technical one.

On your own device you have options with real limits. A VPN encrypts traffic between you and its endpoint, so the local network cannot inspect it, but the VPN operator then occupies the same position. Using a different network entirely is the only complete answer. The full explanation is here.