The MITM proxy architecture creates a central system (or systems) with privileged in-band[1] access to all clear text traffic of the organisation. This central

The MITM proxy architecture creates a central system (or systems) with privileged in-band[1] access to all clear text traffic of the organisation. This central system would have an enormous attack surface because of the millions of lines of code[2] required to handle the TLS protocol, parse protocol messages, etc. The MITM proxy architecture also introduces an extreme risk of exposing one of the most sensitive private keys of the organisation (trusted by all computers of the organisation) in the event the MITM proxy system is compromised. I'm more inclined to consider the MITM proxy architecture as an anti-pattern as it undermines proper isolation between systems on the network and undermines the concept of perfect forward secrecy. [1] (meaning: directly in the flow of data such that the data can be manipulated by an attacker) [2] By example, OpenSSL consists of 0.7 million lines of code per https://www.openhub.net/p/openssl/analyses/latest/languages_summary https://www.openhub.net/p/openssl/analyses/latest/languages_... and Wireshark consists of 4.5 million lines of code per https://www.openhub.net/p/wireshark/analyses/latest/languages_summary https://www.openhub.net/p/wireshark/analyses/latest/language...