TLS Interception

The TLS Interception page controls the man-in-the-middle proxy that lets Lucien inspect encrypted traffic to the AI services you choose. The proxy terminates TLS for a short, explicit list of domains using its own certificate authority, reads the prompt, scores it, then re-encrypts and forwards it. Everything not on the list is tunnelled straight through, untouched.

The page is a numbered flow (Step 1 Certificate Authority, Step 2 Intercepted Domains, Step 3 Inspection) plus a Proxy Listener block and a single Save changes.

Step 1: Certificate Authority

Shows the CA the proxy uses to sign certificates for intercepted domains, with an Installed badge, the CA file (rootCA.pem), its validity and subject, and a days-until-expiry countdown.

• Download certificate (.pem) saves the CA's public certificate to distribute to clients that must trust the proxy.
• Replace CA offers Upload org CA (your organisation's own CA, for a managed network) and Generate new (a fresh self-signed CA, for a lab).

Private keys never leave the appliance. Download only ever provides the public CA certificate. The private key stays on the appliance.

Step 2: Intercepted Domains

The explicit allow-list of domains the proxy decrypts (e.g. claude.ai, grok.com, chatgpt.com, gemini.google.com). Each is a chip with a delete icon; Add a domain + Add appends one. Only domains listed here are ever decrypted.

Step 3: Inspection

• Score prompts: when on, prompt text from intercepted requests is sent to the scoring engine. When off, matching traffic is decrypted but passed through without inspection.
• Block on violation: when on, requests the engine returns a BLOCK verdict for are dropped. When off, violations are recorded but the request still reaches the model (monitor-only).
• Scoring engine: the address prompts are sent to (127.0.0.1:50051, the local Lucien engine).

Proxy Listener

Listen port (default 8080), Certificate directory (default .), and Log level (debug / info / warn / error; info is normal). Save changes writes the domain list and inspection settings to /opt/lucien-firewall/config.json.

Recommended rollout

1. Establish trust once: upload your org CA (managed network) or use the installed CA and download its .pem to install on clients (lab).
2. Add only the AI domains you intend to monitor; remove any you do not.
3. Turn on Score prompts; start with Block on violation off (monitor-only) while you tune.
4. Watch what gets flagged in Security Lab and Reports, confirm the verdicts, then turn blocking on.
5. Leave the listener at defaults unless troubleshooting; raise the log level to debug only while diagnosing.
6. Click Save changes.

Replacing or generating a CA, editing the domain list, toggling inspection, changing the listener and saving are Administrator-only.