I am looking into how SSL inspection works. I have some general ideas how it works but I could not figure out a couple of issues.
When SSL inspection is used on client accessing some non-mainstream sites (Let's say https://neverheardof.net). Wouldn't the SSL inspector needs to sign a certificate on the fly? What if the attacker is the client and it generates a bunch of requests to rarely used sites? Would that bring down the SSL inspector?
On the other hand, if the visiting site uses a in-secured certificate, either expired, invalid or self-signed, what could the SSL inspector do? If it signs the certificate, it will mask security problem. If it rejects the certificate, it will deny the client access. If it passes through the cert, will it still be able to inspect?