Your IT department owns a certificate authority. They add its self-signed, root certificate to the trust stores of all the machines in your firm using group pol

Your IT department owns a certificate authority. They add its self-signed, root certificate to the trust stores of all the machines in your firm using group policies or whatever. They then install something like a Bluecoat browsing proxy, which they configure your browsers to use using group policies or whatever. The Bluecoat terminates the TLS connection by transparently providing certificates for the sites that you're trying to access, which your browser trusts. It then makes the outbound connection to the actual site, if appropriate. It's called TLS interception.