TLS termination

TLS termination occurs at a TLS peer that decrypts incoming records and participates in the channel authentication and key agreement. An intermediary terminating one TLS channel and initiating another is an endpoint of each channel, not an opaque forwarder.

Suppose client A uses a protected channel to proxy P, which reads the message and sends it over a second protected channel to service B. Even if both channels protect against outsiders, P has the plaintext by construction. Therefore the conjunction of those channel protections does not imply cryptographic confidentiality from P. This counterexample does not imply that P is unauthorised; it identifies a trust assumption that application designers must state.