Question. I'm a software developer. I design and write secured systems for my customer. My customer recently downward directed that all traffic to/from my server be routed through a new appliance. I have no idea what the appliance is. All I was told was that it would impact routing and client certificates. I was given the name of a person to work with and off we went. We use client certificates for authentication and all traffic to/from the server is encrypted. Here is where things get weird. Previously, my server had it's own SSL certificate issued to it's current host name. Now when I hit the site, I see a host name of the new appliance for the site's SSL certificate, not my server's host name. Also. When a client certificate arrives at my server, it is no longer reading as having been issued by who I know to be the original issuer. But there are no negotiation errors during the handshake. Everything is green in the browser.
The only thing that makes any sense is that this appliance is decrypting the traffic from the client before it gets to my server so that it can be logged and inspected, before re-encrypting it and sending it along to my server. Then, when it gets the reply from the server, it likewise decrypts, logs, inspects the data, before re-encrypting it and the forwards the data.
Is my understanding of asymmetric and symmetric cryptography serving me correctly here? Mostly I stick to the logic of my applications and have sufficient understand of cryptography to be able to do what I need to do and ensure my systems remain secure. But I am not intimately familiar with the ins and outs of how it always functions. Seems like my organization just installed an internal man in the middle device for monitoring purposes and didn't tell me what was really going on.
Is this plausible?