MITM attack detection
Companies often install a custom "Root Certificate" on employee devices. This allows their security systems (like firewalls or DLP) to intercept, decrypt, and inspect all your HTTPS traffic (passwords, messages, banking) without triggering browser warnings, effectively performing a legal Man-in-the-Middle (MITM) attack.
When these security systems intercept traffic, they often renegotiate the connection using an older, more compatible protocol (like TLS 1.2 instead of 1.3) to simplify inspection. Therefore, detecting a downgrade from TLS 1.3 to 1.2 is a strong indicator that your traffic is being intercepted and decrypted.
