Perhaps think a bit smaller, and look at companies that operate office-sized TLS interception by installing a CA certificate on each (managed) end device, and generating certificates on-the-fly from that CA. Then, some middlebox is able to inspect the encrypted communication that passes through.
Some web browsers have pinned certificates for certain services, Google Chrome/Chromium being one of those. Subsequently, the browser refuses to perform any more actions towards the server that serves an invalid (according to the browser) certificate. That browser is also one of the reasons the DigiNotar case in 2011 emerged to the surface.
Comments
Perhaps think a bit smaller, and look at companies that operate office-sized TLS interception by installing a CA certificate on each (managed) end device, and generating certificates on-the-fly from that CA. Then, some middlebox is able to inspect the encrypted communication that passes through.
Some web browsers have pinned certificates for certain services, Google Chrome/Chromium being one of those. Subsequently, the browser refuses to perform any more actions towards the server that serves an invalid (according to the browser) certificate. That browser is also one of the reasons the DigiNotar case in 2011 emerged to the surface.