3 ms·

tldr: encryption (ssl) breaks DPI.

• bradknowles 5y ago
  Not really. There are hundreds of CAs in the world, any one of which can issue you certs that would cover all possible domains in existence. You could then trivially apply man-in-the-middle attacks to all traffic passing through your systems. SSL is a good start, but not the complete solution. You need to also harden yourself against those MITM attacks. The best way I know to do that is to run a VPN for your entire local network, to a VPN provider that you trust. And that probably shouldn’t be OpenVPN, but instead WireGuard. Do that, and you should be reasonably well protected against DPI attacks on your traffic.