A financial firm must inspect outbound HTTPS to block data exfiltration, but auditors require that internal clients trust the inspection without browser errors and private keys stay protected. Which SSL/TLS proxy certificate handling best enables decrypt-and-inspect?
Select an answer to reveal the explanation.
Short Explanation
You're playing trusted middleman, not impostor. An enterprise subordinate CA lets the edge re-sign sites cleanly while clients keep trusting the chain.
Full Explanation
SSL/TLS proxy decrypts outbound sessions by presenting a locally generated server certificate that mimics the real destination, which only works without errors when that issuer chains to an enterprise CA already trusted by clients and whose private key is secured and scoped for proxy use, enabling policy inspection for exfiltration. Using a self-signed peer edge certificate fails by concept because clients do not trust random edge identities, causing errors and bypasses. Installing a public internet server certificate fails by concept because a website certificate for a specific domain cannot authoritatively re-sign arbitrary destinations and mishandles private key custody. Using the DTLS control-plane certificate fails by concept because controller and validator identity certificates authenticate fabric control, not client-facing TLS interception. Exam caveat: deploy the proxy CA via trusted store and exempt sensitive categories per policy, and practical check is to verify client chain trust and logged decrypt actions in SD-WAN Manager.