In this case &quot;endpoint-trusted&quot; mean that it&#x27;s a CA that is trusted by the client on the local network. What happens is that the box intercepts all traffic and establishes it&#x27;s own TLS session with the remote server while establishing a different session under it&#x27;s own CA with the client. Then any traffic sent by the client is decrypted, analyzed, and re-encrypted under the real server&#x27;s session. (And the reverse for traffic coming back.)