Endpoint-assisted inspection of encrypted network traffic

A method comprising:

• detecting, by a monitoring agent of a device, a handshake between the device and a remote entity to form an encrypted traffic session;
• capturing, by the monitoring agent, keying information for the session from the handshake;
• providing, by the monitoring agent, the captured keying information to a traffic inspection service, wherein the traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session and applies a policy to the traffic session based on the decrypted traffic;
• and
• delaying, by the monitoring agent, providing of the encrypted traffic from the device to the remote entity, until the traffic inspection service acknowledges receipt of the provided keying information.

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• obtain, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity;
• provide a notification to the monitoring agent that acknowledges receipt of the keying information;
• use the keying information to decrypt encrypted traffic from the encrypted traffic session;
• and
• apply a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session.