Comment by zmgsabst

Many years ago I started to describe how it works in an HN comment and some reply complained about the idea of terminating TLS, i.e., decrypting, and then re-encrypting. Obviously this sacrifices something, e.g, speed, in order to gain _control_

But this is what Cloudflare does and no one seems to mind

Large companies also do this to protect their LANs

I'm not running a CDN, only a small home LAN. I'm only procesing a small amount of traffic on a personal computer. This setup is fast enough for me, it's not slow at all

The basic configuration is generally:

1. Configure DNS to point to the local proxy listening address #1, a local address, e.g., using a wildcard in a zone file

2. Configure the proxy to terminate TLS, "do stuff", and then forward to proxy UNIX socket path #2 or proxy listening address #2

3. After doing the stuff, the proxy then sends the traffic over the internet

The "do stuff" part is personal. It depends on what one wants to do. There are seemingly endless possibilities

It's not likely the constantly changing configurations I use would be suitable for others. It's all based on personal preferences and usage habits

I rarely use a graphical browser, for example

I don't make piecemeal remote DNS queries like most www users. (IME, most A RR's stay the same over long periods.) I get bulk DNS data periodicallly from a variety of sources and load it into the proxy's memory. When I make an HTTP request there is either no DNS lookup because I'm using the IP address of the proxy or there is a single, local DNS lookup which returns the address of the proxy. There is no access to remote DNS

When I first decided to start inspecting own TLS traffic by terminating and re-encrypting, I initially tested the idea using socat

After I saw that it worked, I started using other software like haproxy

I never expected this approach would work well enough but many years have gone by and I'm still using it. The configurations I use are much longer and more complicated than any sample I have ever seen on the www

It's funny that Cloudflare is decrypting and re-encryting _other peoples'_ traffic, and this is thought to be AOK, but aside from large companies few people seem interested in doing this with their _own_ traffic on their _own_ computers on their _own_ networks

It can be useful, IMHO