Reverse proxy inspection for encrypted traffic in an edge-based network

A system for reverse proxy inspection (RPI) of encrypted traffic in an edge-based network, comprising:

• at least one processor;
• and
• a non-transitory processor-readable memory device storing instructions that when executed by the at least one processor causes the at least one processor to perform operations including:
• sharing a first certificate from an RPI instance of the network to an edge-based network gateway of the network, wherein the first certificate is issued to the RPI instance;
• receiving, at the RPI instance, an encrypted message with an initial layer of encryption and a subsequent layer of encryption, wherein the initial layer of encryption is encrypted using a second certificate issued to an edge-based network device of the network, and the subsequent layer of encryption is encrypted using the first certificate;
• authenticating, at the RPI instance, the first certificate;
• decrypting, at the RPI instance, the subsequent layer of encryption using the first certificate, resulting in the encrypted message with the initial layer of encryption intact;
• inspecting, at the RPI instance, the encrypted message;
• and
• forwarding the encrypted message from the RPI instance to a centralized hub of the network.

A computer program product for reverse proxy inspection (RPI) of encrypted traffic in an edge-based network, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

• share a first certificate from an RPI instance of the network to an edge-based network gateway of the network, wherein the first certificate is issued to the RPI instance;
• receive, at the RPI instance, an encrypted message with an initial layer of encryption and a subsequent layer of encryption, wherein the initial layer of encryption is encrypted using a second certificate issued to an edge-based network device of the network, and the subsequent layer of encryption is encrypted using the first certificate;
• authenticate, at the RPI instance, the first certificate;
• decrypt, at the RPI instance, the subsequent layer of encryption using the first certificate, resulting in the encrypted message with the initial layer of encryption intact;
• inspect, at the RPI instance, the encrypted message;
• and
• forward the encrypted message from the RPI instance to a centralized hub of the network.