Monsters in the Middleboxes: Detecting HTTPS Interception

In this blog post, we provide a brief recap of HTTPS interception and introduce two new tools:

In a basic HTTPS connection, a browser (client) establishes a TLS connection directly to an origin server to send requests and download content. A TLS-terminating forward proxy sits in front of a client in a TLS connection, transparently forwarding and possibly modifying traffic from the browser to the destination server. Reverse proxies are often used by origin servers to improve the security of client HTTPS connections (for example, by enforcing strict security policies and using the newest security protocols like TLS 1.3).

Source: blog.cloudflare.com