Er... yes. That's how nearly all web security products work. The only way for them to monitor (and filter) HTTPs content is the MITM + fake cert. This is done everywhere: from that websense or bluecoat proxy appliance at the office, to the boxes by someone like a Sandvine doing DPI on telco core networks.<p>Of course, this is unacceptable - but there are very few alternatives. For the record, we - rawstream - don't do this as its crazy to compromise security like this. So we had to find other means.