TLS Interception at a Forward Proxy

A TLS-inspecting (SSL-inspecting) forward proxy is not a single encrypted tunnel — it is two independent TLS sessions joined by a brief plaintext window inside the proxy itself. This simulator renders that pipeline in 3D: client connections travel to the proxy over one TLS session, get decrypted and classified against an editable security policy, and — if allowed — are re-encrypted onto a second TLS session toward the real origin server. Toggling inspection off shows the blind spot it exists to close: connections become opaque again and policy can no longer see, let alone block, what's inside them. Live counters track inspected, blocked, and caught-threat connections alongside the connections that would have been blocked but weren't, plus the processing latency the extra decrypt/re-encrypt hop adds.