enclave-tls-interceptor

TLS session interception for a secure proxy is handled by managing the session lifecycle and generating domain-specific leaf certificates on demand. This ensures encrypted communication between the proxy and external services.

Ephemeral certificate generation creates a self-signed RSA 2048 CA certificate for each session. It then issues on-demand domain-specific leaf certificates signed by that CA to secure communication.

Yes, node-forge is required as a dependency to handle X.509 certificate generation. It provides the cryptographic functions needed to create the CA and leaf certificates during the session lifecycle.

Yes, TLS interception secures data transmission to external services by generating ephemeral CA and leaf certificates. This ensures all communication remains encrypted throughout the proxy session lifecycle.

The best way to manage per-domain leaf certificates is generating them on demand during the session lifecycle. A self-signed RSA 2048 CA certificate signs each domain-specific leaf certificate for secure communication.

Ephemeral CA certificates for TLS interception are tied to the session lifecycle and should not be used when persistent trust is required. Since the CA is regenerated per session, long-term certificate pinning will fail.