Who changed your lock?

Your network connection is encrypted. Okay, that’s good, but who controls the other end? That’s the question you should be asking yourself, because it’s not necessarily your bank (or any other website you think you’re visiting). When the connection is tampered with, it’s called “SSL inspection.” Whether it’s a safety feature or a network attack depends on who does it and why. Either way, don’t expect your browser to tell you.

No proxy left its mark. Proxies often stamp the requests they pass along, and yours came in clean. Some don’t bother stamping, so check a website below to be sure.

You should know that something can sit between you and the website you visit: an interceptor. It changes your network security by tossing your lock in the garbage, bolting on one of its own, and keeping the key. It’s like a shady landlord who rekeys your door and pockets a copy “for emergencies.” Your browser sees a lock, relaxes, and is none the wiser. Nobody told it about the swap, on purpose, because whoever switched it out also made your device trust the new lock and its key (which makes you none the wiser).

Show the connection Secure Direct Connection MITM Attack

Original security certificateDigiCert TLS certificate
Your Device
Address bar: yourbank.com
yourbank.com
Connection is secure
Certificate is valid
Issued by DigiCert
The bank’s own lock. Your browser accepts it because a certificate authority it trusts has vouched for the bank.
Network Connection
It’s locked at both ends, both ways. Only your browser and the bank hold the key, and only they can read the traffic passing over the secure connection.
Original security certificate
Your Bank
The real lock, put on by the bank’s server.

Replaced security certificateInterceptors-R-Us TLS certificate
Your Device
Address bar: yourbank.com
yourbank.com
Connection is secure
Certificate is valid
Issued by Interceptors-R-Us
A lock the interceptor made. Your browser accepts it because someone installed the interceptor’s certificate on your computer as trusted (even if that was you and you didn’t know it).
Unlocked toward your device

The Interceptor
It connects to your browser and unlocks your traffic, then locks it again toward your bank, both ways. In between, the traffic is out in the open: the interceptor can read it, store a copy, change it in real time, or all of the above.
It reads the password you send, the balance your bank sends back and the account statement you download. All of it is in plain sight. A stranger sees your password, and sees your balance before you do.
It keeps a copy: every page, search and upload, tagged to you and kept for as long as somebody’s retention policy says. You’ve never seen that policy, and the log is one more thing waiting to get breached.
It can rewrite what passes through: block a page, swap a download, slip a script into your bank’s site, or change the account number on a transfer. Your browser raises no alarm, and the lock looks the same.

Re-encrypted to destination bank
Original security certificate
Your Bank
The real lock, put on by the bank’s server.

What you can see:

What you can see At Face ValueFace Value Looking CloserCloser

Legend:

Original secure connection
Replacement secure connection

Both are real HTTPS. Your browser checks the interceptor’s certificate, finds it trusted, and encrypts everything, exactly as it should. But the interceptor made that lock and holds the key, so at its end it takes the lock off, reads your traffic in both directions, and locks it again for the rest of the trip. It’s encrypted the whole way, just not end-to-end, and it’s 100% readable at the one stop that matters: in a stranger’s hands.

Where the interceptor sits:

On your computer: antivirus or other security software
On your network: the firewall at the office or school
In the cloud: a security service your traffic is routed through

So who does this? Who tampers with the secure connection of your browser? Lots of people.

Let’s start with your employer: they break the connection and call it “security.” And antivirus software makers call it “HTTPS scanning” and sell it as a feature to your employer.

Then there’s your kid’s school. Federal law ties its E-rate money to filtering the web, and a filter can’t read a page it hasn’t already unlocked. One vendor advertises its “trusted MITM proxy” in so many words. MITM is industry shorthand for man in the middle: the lock-swapper described up top, sitting on the line and reading both ends of the conversation (or worse). To the school, that’s a purchase order. Your kid sits at one of those ends. Points for candor.

None of them leave a note.

“The fact that ‘SSL inspection’ is a phrase that exists, should be a blazing red flag that what you think SSL is doing for you is fundamentally broken.”

Will Dormann, CERT Coordination Center at Carnegie Mellon, “The Risks of SSL Inspection” (2015)

LockFib checks the lock. If the website didn’t put it there, we’ll tell you.

How we check

The certificate. Name a website and we’ll fetch its certificate from our end of the internet. Every certificate carries a fingerprint, 64 characters that belong to it and nothing else. Compare ours with the one your browser got. If they differ, someone switched certificates on the way to you.

ours3F 9A 41 0C E7 22 B8 5D 19 6E A3 F0 47 C2 88 1B … 7D 04
yoursA1 07 41 0C E7 22 B8 5D 19 6E A3 F0 47 C2 88 1B … 7D 04

Made-up fingerprints. Spot the difference.

Nothing stays the same

Chrome retired the padlock in 2023 because most people thought it meant “safe.” It never did. Now the certificate hides behind the little settings icon left of the address. Click it, then “Connection is secure,” then “Certificate is valid.” Firefox shows a shield, and Safari dropped its lock in 2025. Neither tells you more than Chrome’s symbol, but click Firefox’s shield, or open Connection Security Details from Safari’s menu, to look closer.

As of October 2026, Mozilla’s help page says a check-mark shield means you’re “definitely connected” to the site in the address bar and “the connection hasn’t been intercepted.” Definitely. Certainly. No interceptions whatsoever. But Firefox’s own code knows better. When the lock comes from an issuer Mozilla never shipped, the kind your employer or your antivirus installs, the address bar looks the same. You have to open the panel to see the admission: “Connection verified by a certificate issuer that is not recognized by Mozilla.” That’s the interceptor doing its work, changing the lock and key. Click the shield and read it for yourself. But you can skip the Extended Validation (EV) check Mozilla suggests for a closer look because it merely names the company that owns the website. It doesn’t tell you who sits in the middle, reading your traffic. Besides, Firefox stopped showing it in the address bar in 2019. And while EV certificates definitely cost more, they certainly never stopped any network interceptor whatsoever. A marketing gimmick. Let’s Encrypt now hands out the same lock for free.

Squint at the issuer before the fingerprint. If ours says “Let’s Encrypt” and yours says “Zscaler Intermediate Root CA,” you can stop squinting: you’ve been intercepted.

What won’t stop an interceptor

An interceptor with its root certificate on your device can forge a certificate for any website, and your device will believe it. Every defense that asks “is this certificate valid?” gets a yes. And everything you send, and what the website sends back, reaches the interceptor first.

HSTS, preload list included. It forces HTTPS and won’t let you click past a certificate error. The interceptor’s certificate isn’t an error.
HTTPS-Only mode. Same story as HSTS.
DNSSEC. It protects the address lookup, not the connection that follows.
DNS over HTTPS. It encrypts the lookup too. Your connection to the website is a separate one.
A VPN. An interceptor on your device reads your traffic before the VPN encrypts it.
TLS 1.3, strong ciphers, forward secrecy. They stop eavesdroppers on the wire. The interceptor isn’t on the wire, it’s on your end of the connection.
Encrypted Client Hello. It hides which website you’re visiting from onlookers. The interceptor decrypts the connection, name included.
EV and OV certificates. They name the company that owns the website, not the one reading your traffic.
CAA records. They tell public certificate authorities who may issue for a website. An interceptor never asks and can’t be bothered.
Certificate Transparency. Chrome checks it only for publicly trusted roots. Roots installed on your device, such as those from antivirus or your employer, skip it entirely.
Certificate pinning. Pinning caught DigiNotar, a public authority. Chrome skips pins when the chain ends at a root installed on your device, so an interceptor reads pinned websites too.
HTTP/2 and HTTP/3. Same TLS, same certificate check, same interceptor.
Content-Security-Policy and Subresource Integrity. The interceptor can rewrite the page, policy and hashes included. We use both anyway; they guard against other things.
Secure cookies. “Secure” means “HTTPS only,” and the interceptor is part of the HTTPS.

What we don’t promise

Anyone who controls your connection can rewrite this page too, including the verdict that says you’re fine. Routine interceptors leave pages alone; a determined one might not.
Not every mismatch has a villain behind it. Big sites run a separate certificate in each data center, and certificates get replaced every few months. We’ll say so when we think that’s what you’re looking at.
On a work computer, the interceptor is almost certainly your employer, and it’s usually legal. It’s their computer. Ask IT before you call a lawyer to challenge the policy you agreed to.
We check the lock, not what happens behind it. A browser extension that reads your pages does it after they’re decrypted, never touching the lock, so we can’t see what it’s doing.
Someone with admin rights on your computer can make any page say anything, even this one.
Cloudflare holds our lock, on purpose. It takes the floods we can’t, and it can read what you send us. Our privacy policy explains the trade.