"proxy/MitM" (man-in-the-middle) means the enterprise appliance terminates the TLS connections. The client negotiates the session key with the enterprise applia

"proxy/MitM" (man-in-the-middle) means the enterprise appliance terminates the TLS connections. The client negotiates the session key with the enterprise appliance. The custom user-installed CA grants trust to certs the appliance generates for the destination domains. The appliance decrypts the traffic, and then re-encrypts while relaying it over a TLS connection to the actual destination, and vice-versa. This works. This is what the trusted CA root system is normally intended to prevent.