TLENVOY - A Tool for TLS Termination and Inspection

Abstract

With the increasing adaption on encrypted communication over the internet, ensuring the security over network traffic has become very crucial. Transport Layer Security (TLS) is now widely used to secure data in transit, but at the same time it also poses challenges for network administrators who need to inspect traffic for malicious content or policy violations. This paper explores the use of Envoy, an open-source edge and service proxy, as a forward proxy to inspect TLS traffic. By leveraging Envoy's capabilities, organizations can maintain a secure environment for all nodes behind the proxy. We discuss the architecture, implementation, security considerations, and potential challenges of using Envoy for TLS inspection. The paper concludes with recommendations for deploying such a system in a secure and efficient manner.