Drift ·
The second connection: what TLS inspection does to trust
Inspecting traffic means re-opening it. That leg carries its own trust decision.
Any tool that inspects TLS traffic — a proxy, a DLP gateway, an agent monitor — does the same thing structurally. It terminates the connection the client opened, and it opens a new one to the real destination. The client's trust decision is now the tool's trust decision. That second connection carries its own trust decision, and it tends to receive less scrutiny than the first.
The common proxy libraries ship with certificate verification disabled on that outbound leg. There are reasonable historical reasons: these libraries began life as debugging tools, where connecting to anything at all was the point. The default survived into production use, where it means something very different.
What it means is specific. A tool in that state will accept any certificate presented by whatever answers at the upstream address. Anyone positioned between the inspection tool and the provider can present their own, impersonate the API, and have the response relayed onward as authentic. The client sees a valid connection throughout, because from its perspective there is one — to the tool.
We found this default in our own build, verified it by standing up an upstream with a certificate nothing on earth trusts and watching the body come back through, and fixed it. Verification now fails closed, with an explicit CA-bundle setting so self-hosted inference keeps verification on rather than trading it away.
The general lesson is not that a library had an unsafe default. It is that the default was silent. Nothing errored, nothing logged, nothing looked wrong. For anything that terminates TLS on your behalf, the useful question is not whether it encrypts, but what it verifies on the leg you cannot observe, and how that can be demonstrated.
There is a second property in the same place. Hybrid post-quantum key exchange is now the default in modern TLS stacks, so an inspection tool built on an older one will re-negotiate the session down to classical encryption without anything appearing wrong. Harvestable today, readable later. It is measurable in the same handshake, and worth measuring at the same time.