Editing Proxy server (section)

====Filtering of encrypted data====
Web filtering proxies are not able to peer inside secure sockets HTTP transactions, assuming the chain-of-trust of SSL/TLS ([[Transport Layer Security]]) has not been tampered with. The SSL/TLS chain-of-trust relies on trusted root [[Certificate authority|certificate authorities]].

In a workplace setting where the client is managed by the organization, devices may be configured to trust a root certificate whose private key is known to the proxy. In such situations, proxy analysis of the contents of an SSL/TLS transaction becomes possible. The proxy is effectively operating a [[man-in-the-middle attack]], allowed by the client's trust of a root certificate the proxy owns.