Can network administrator sniff and decode SSL traffic to get sensitive information like Gmail password, Skype password, Windows email account, or Remote Desktop .... ?

  • Unfortunately, questions about networks you do not directly control are explicitly off-topic here, as are questions about bypassing network security or policies.
    – Ron Maupin
    Feb 24, 2019 at 16:57
  • @RonMaupin I just edit the question to fit the rule.
    – joe
    Feb 25, 2019 at 3:47
  • ?!? Then, you would be the network administrator, and you would know the answer.
    – Ron Maupin
    Feb 25, 2019 at 3:50

1 Answer 1


Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection.

SSL deep inspection replaces the server certificate and requires an alternative CA root certificate to be installed on all clients. You can easily detect this by inspecting the certificate chain. SSL deep inspection uses Man-in-the-Middle decryption and reencryption, and should be well documented and policed inside the company.

  • Hi! Thank you very much for your answer, "You can easily detect this by inspecting the certificate chain", how can I do that? They just tell me to install FortiClient on my laptop and tell me to connect to the VPN, so is that safe?
    – joe
    Feb 24, 2019 at 12:54
  • 1
    Also, all the methods mentioned by Zac are not possible if the encryption uses TLS 1.3.
    – user36472
    Feb 24, 2019 at 13:06
  • @Crown thank you very much! that's great new for web browser. But I just connected to a Windows Server 2008 R2 RDP and it's not TLS 1.3, still a bit worry.
    – joe
    Feb 24, 2019 at 13:21
  • @joe E.g. in Firefox, you could right-click on the web page background -> Page information -> Security -> Show certificate -> Details.
    – Zac67
    Feb 24, 2019 at 13:53
  • @Cown Why not? PFS does not protect against MitM.
    – Zac67
    Feb 24, 2019 at 14:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.