You ship something. It works on your machine, in CI, in staging, and for every user who tries it. Then one customer opens a ticket: it doesn't work for them. Same version, same config, same everything. It just hangs, or throws a certificate error, or fails in some way your error handling never anticipated.
They're on a corporate network. Somewhere between their machine and your server, a device is opening every TLS connection, reading it, and building a new one.
This is normal. Large organisations are often legally required to inspect traffic leaving their network, and they've been doing it for twenty years. The problem isn't that it happens. The problem is that from where you're standing, it's nearly invisible — and the failures it causes look like bugs in your code.
Here's what's actually happening, why five different things break in five different ways, and how to work out which one you're looking at without access to the customer's network team.
What interception actually does
