The padlock in your browser tells you the connection is encrypted. It does not tell you who is on the other end of that encryption. On millions of corporate and school devices, the answer is a middlebox in the IT department, decrypting and re-encrypting every HTTPS request before it ever reaches the real website.
TLS interception, sometimes sold as "SSL inspection" or "HTTPS filtering," is a standard feature in enterprise security products. Firewalls and secure web gateways from most major vendors ship with it. The stated purpose is reasonable on its face: malware arrives over HTTPS too, and a filter that cannot see inside encrypted traffic cannot scan it.
What the feature actually does is run a man-in-the-middle attack against every user behind it, with permission from the device owner rather than the person typing. Understanding the mechanics matters, because the same trick shows up in contexts far less benign than a corporate firewall.
How the interception actually works
TLS normally prevents interception because the server proves its identity with a certificate signed by a certificate authority your browser already trusts. A proxy sitting in the middle cannot present a valid certificate for your bank's hostname, so the connection fails.
