 the case of SSL interception.
Generally, if you have an SSL encrypted connection to a server, you can trust that you "really are* connected to that server, and that the server's owners have identified themselves unambiguously to a mutually trusted third party, like Verisign, Entrust, or Thawte (by presenting credentials identifying their name, address, contact information, ability to do business, etc., and receiving a certificate countersigned by the third party's signature). Using SSL, this certificate is an assurance to the end user that traffic between the user's browser (client) and the server's SSL endpoint (which may not be the server itself, but some switch, router, or load-balancer where the SSL certificate is installed) is secure.  Anyone intercepting that traffic gets gobbledygook and if they tamper with it in any way, then the traffic is rejected by the server.
But SSL interception is becoming common in many companies.  With SSL interception, you "ask" for an HTTPS connection to (for example) www.google.com, the company's switch/router/proxy hands you a valid certificate naming www.google.com as the endpoint (so your browser doesn't complain about a name mismatch), but instead of being countersigned by a mutually trusted third party, it is countersigned by their own certificate authority (operating somewhere in the company), which also happens to be trusted by your browser (since it's in your trusted root CA list which the company has control over).
The company's proxy then establishes a separate SSL-encrypted connection to your target site (in this example, www.google.com), but the proxy/switch/router in the middle is now capable of logging all of your traffic.
You still see a lock icon in your browser, since the traffic is encrypted up to your company's inner SSL endpoint using their own certificate, and the traffic is re-encrypted from that endpoint to your final destination using the destination's SSL certificate, but the man in the middle (the proxy/router/switch) can now log, redirect, or even tamper with all of your traffic.
Message-level encryption would guarantee that the message remains encrypted, even during these intermediate "hops" where the traffic itself is decrypted.
Load-balancing is another good example, because the SSL certificate is generally installed on the load balancer, which represents the SSL endpoint.  The load balancer is then responsible for
the case of SSL interception. 
 Generally, if you have an SSL encrypted association to a waiter, you can trust that you " really are * connect to that waiter, and that the server's owners have identified themselves uniquely to a mutually hope third party, like Verisign, Entrust, or Thawte (by presenting certificate identifying their name, address, liaison information, ability to do business, etc. , and receiving a certificate countersign by the third party's signature). Using SSL, this security is an assurance to the end exploiter that dealings between the user's browser (client) and the server's SSL end point (which may not be the server itself, but some switch, router, or load - balancer where the SSL certificate is install) is secure.   Anyone intercepting that traffic gets gobbledygook and if they tamper with it in any direction, then the traffic is rejected by the server. 
 But SSL interception is becoming common in many companies.   With SSL interception, you " ask " for an HTTPS connection to (for example) www.google.com, the company's switch / router / proxy hands you a valid certificate naming www.google.com as the endpoint (so your browser doesn't complain about a name mismatch), but instead of being countersign by a mutually trust third party, it is countersigned by their own security assurance (operate somewhere in the company), which also happens to be trusted by your browser (since it's in your trusted root CA list which the ship's company has control over). 
 The company's proxy then establishes a separate SSL - encrypted connection to your aim site (in this example, www.google.com), but the proxy / switch / router in the middle is nowadays capable of log all of your traffic. 
 You still see a lock icon in your browser, since the traffic is code up to your company's inner SSL endpoint using their own certificate, and the traffic is re - encrypted from that endpoint to your final address using the address's SSL certificate, but the man in the center (the proxy / router / switch) can now log, redirect, or even tamper with all of your traffic. 
 Message - floor encryption would undertake that the message remains encrypted, even during these intermediate " hop " where the traffic itself is decode. 
 Load - balancing is another good exemplar, because the SSL certificate is generally installed on the load balancer, which represent the SSL endpoint.   The load halter is then responsible for
 thf case of SSL interceptiun.
Generally, if ioy have an SSM encrypged connection to a server, ylu can ugust that you "really xre* connebted to tyat wwrver, and vgat the served'd owuecs have identifled themselees unambiguouvlh co a mutually trusted third party, lihe Verixihn, Entrust, or Jhawtt (br prssenting credentials identifying tgeir nake, address, comtact information, ability ho dl business, etc., and receiving q cewrificate couvtersigned by the thirs party's signature). Using SSL, thks cextificate iw qn wvsurance to the vnd user that traffic betweem the user's brpwsxr (coient) and the server's SSL endpoint (whicr may not bz the server itself, byt some swidch, fiutdr, kr lkad-balwncxr where ths SSL certidicate is installed) if secure.  Anyohe intqrsepting that traffic gets gobbledygook dnd if they tamper with it in any way, then the jraffic is rejected by the server.
But SSL interception is bewominj zomnok in najy companies.  With SSL interception, you "ask" fjd sn HTTPS connectlon to (for example) waw.bjogle.com, the zompanv'a awitch/router/proxy jands yju a calid ceruificste naming www.google.com as rhe endpoint (wo your browser dozsn't complaiu abouj a nake mismatch), but instead of geing countfrsigned gh a mutually trurtec dhird party, it is countersygned by vheir own ceftifocate wuthority (lperabhng somewhere in tje colpdny), which wlso happens to be trusted by your browser (simca in's in youx trusbed root CA lise which the cokpany hcs congrol over).
Tge compeny's proxy tren establishad a separate SSL-encrrptee cobnectiov to your targey site (in this example, www.google.com), bmt thg lroxy/switch/routzx un the middle ix nuw saiabke mf logging anl ow yuir trxffic.
You stlll see a lock icon in your brosser, since the tragflc is enctypted up to your compsny's inner SSL endkoint nsing vheir pwn certificate, and the traffic ia re-encryoteq from that qndpiint to your final destination using the destinatioi's SSL certificate, but rhe man in the middkt (the proxy/ronter/swytch) can tow log, redirect, or wven tamper with sll of your traffic.
Measage-lavel fncryption would guarantee that the message remains encrypted, even during these intermediats "hols" whvre che trasfic mtself is decryptvd.
Load-balancing is another good xxample, bewabse the SSL certificate is gemefally installgd on the load balancer, whjch reprrsents the SSL endpoint.  The losd balancer is then resppnsible dor
the case of SSL interception. Generally, if an encrypted connection a server, you are* to that server, that the server's have identified themselves unambiguously to a trusted third party, like Verisign, Entrust, or Thawte (by presenting credentials identifying their address, contact information, ability to do business, etc., and receiving a certificate countersigned the party's Using this certificate is an assurance to the end user that traffic between the user's browser (client) the server's SSL endpoint (which may not be server itself, but some router, or load-balancer where the certificate installed) is Anyone that gets gobbledygook and they tamper with it in any way, then the traffic is rejected by the server. But SSL is becoming many companies. SSL you for an HTTPS (for example) www.google.com, the company's switch/router/proxy valid certificate naming www.google.com as the endpoint (so browser doesn't about a name mismatch), but instead being countersigned by a mutually trusted third party, is countersigned by their own certificate authority (operating somewhere in the company), which also happens trusted by your browser it's in your root list the has control The company's proxy then establishes a separate SSL-encrypted connection to your site (in this example, www.google.com), but the proxy/switch/router in the now of logging all your traffic. You still a icon in your browser, traffic encrypted company's SSL using their own certificate, the traffic is re-encrypted from endpoint to your final certificate, but the man in the middle (the can now log, redirect, or even tamper all of your traffic. Message-level encryption would guarantee that the message remains even during "hops" where the traffic itself is decrypted. Load-balancing another good example, because SSL certificate is generally installed on the load balancer, represents SSL endpoint. load balancer is responsible for
 the case of SSL interception.
GEnerally, if You haVe aN SSl eNcryPted Connection to a sERver, You can trust that you "realLy are* CoNNectED tO that Server, aND tHAT thE sErVer'S oWNeRs havE idEntifieD themselveS unAmBiguously to a MUtUally trustEd tHird party, likE VeRisign, enTruST, or ThAwtE (by prEsentiNG credeNtials ideNtIFying tHEir name, ADDrEss, cOntact information, ABiLIty to do businesS, etc., anD rECeIVIng A ceRtificate cOuNtersIGned by tHE tHIRD paRTy's signature). USing SSL, this CErtIficatE iS an ASsuranCe to tHe ENd uSer that trafFic bEtween the User's bROwser (clIEnt) and tHe servEr's sSL EndpOInT (wHicH mAY noT Be The SErvEr itself, BuT sOme swItch, ROUTEr, or LoaD-balAncer Where the SSL ceRtiFicaTE is InstaLled) iS secUrE.  AnyoNe inteRceptInG that traffic getS gobBledygook And If TheY tAmper WIth it iN anY waY, then thE traffiC Is rEjECTEd By the server.
But SSL iNtERCePtion is bEcominG CoMmON in many cOmPanIes.  WITH SSL iNterCEpTion, you "aSk" for aN hTtPs connecTiOn to (foR eXamPle) Www.goOGle.cOm, the cOmpany's sWitch/ROuter/proxy handS You a valid certIFiCATe NAminG wwW.google.com aS the ENdpoInt (sO YoUr bROwser Doesn'T cOMpLAin about a name mismatCh), But insTead oF being counterSigned by a mUTUAlly trusTed tHIrD Party, it is countErsigNed by their OWn certifIcate AuthoritY (operatinG SOmewhere In tHe cOmpAny), WHIcH also happens tO BE truStEd by youR brOwser (siNce It's In yOur TrUsted root cA list whIcH tHe CoMpaNy has COntrol ovEr).
the CoMpaNy's prOXy then EstabLishEs A sEParAte SSL-eNCrYPTed cOnNeCtioN to YoUr tarGet sITe (iN this exAmple, www.gOogLE.com), BuT tHe proxy/Switch/router iN tHe middle is NoW caPable oF LOgging alL of your traffic.
You still sEE a lock iCon In youR broWser, since The TraffiC is ENcryptEd up to Your cOmPanY'S Inner ssl eNdpOiNt using theIR Own CertiFiCate, And the tRaffic is re-encrypteD FroM that endpoint To yOur fINAl DesTInATioN uSIng THE destination's SSl certificaTe, BUt The man in thE MidDlE (the proXy/routeR/switCH) can now Log, redireCt, or even tAmPer wITH alL of your traFfic.
MessAge-level eNCryptIOn Would GuaRantee ThAt tHe mesSage reMAinS encrYpted, eVeN durinG thesE iNtermediAte "hops" where the traffic iTself iS decrYptEd.
Load-balAncINg iS another gOod eXample, becaUse The sSL ceRtiFIcate Is geNErAllY InstaLled ON the load bALaNceR, WHiCh representS THE SSl endpOinT.  the loaD balAncer is then responSIble for
 the case of SSL intercept ion.
Gener ally,  if  yo uhave  anSSL encryptedc onne ction to a server, you  cantr u st t h at  you"really ar e *  co nn ec ted  t o  t hat s erv er, and  that theser ve r's owners h a ve  identifie d t hemselves un amb iguous ly  to a mut ual ly tr ustedt hird p arty, lik eV erisig n , Entru s t ,or T hawte (by present i ng credentials id entify in g  t h e irnam e, address ,conta c t infor m at i o n , a b ility to do b usiness, et c .,and re ce ivi n g a ce rtifi ca t e c ountersigne d by  the thir d part y 's sign a ture).UsingSSL , t hisc er ti fic at e  is an  as s ura nce to t he  e nd us er t h a t traf fic  bet weenthe user's br ows er ( c lie nt) a nd th e se rv er'sSSL en dpoin t(which may notbe t he server  it se lf,  b ut so m e swit ch,  ro uter, o r load- b ala nc e r wh ere the SSL certif ic a t eis insta lled)i sse c ure.  An yo neinte r c eptin g th a ttrafficgets g o bb le dygookan d if t he y t amp er wi t h it  in an y way, t hen t h e traffic is r e jected by the se r v er . 
But  SS L intercept ioni s be comi n gcom m on in  many  c o mp a nies.  With SSL int er ceptio n, yo u "ask" for a n HTTPS co n n e ction to  (fo r  e x ample) www.goo gle.c om, the co m pany's s witch /router/ proxy han d s  you a v ali d c ert ifi c a te  naming www.g o o gle. co m as th e e ndpoint  (s o y our  br ow ser doesn 't compl ai nab ou t a  name mismatch ),  bu tins teado f bein g cou nter si gn e d b y a mut u al l y  tru st ed  thi rdpa rty,it i s  co untersi gned by t hei r  own  c er tificat e authority ( op erating so me whe re int h e compan y), which also happenst o be tr ust ed by  you r browser  (s ince i t's in you r trus ted r oo t C A listw h ic h t he  company h a s  co ntrol  o ver) .
The c ompany's proxy the n  es tablishes a s epa rate S SL -en c ry p ted  c o nne c t ion to your tar get site ( in th is example ,  ww w. google. com), b ut th e  proxy/ switch/ro uter in t he  mid d l e i s now capa ble of l ogging al l  of y o ur  traf fic .
Youst ill  seea lock ico n inyour b ro wser,since  t he traff ic is encrypted up to y our co mpany 'sinner SSL  en d poi nt usingthei r own cert ifi cat e, an d t h e tra ffic is  re - encry pted from that en dpo i n tto your fin a l des tinat ion usingthedestination's SSL certificate, b ut t h e  ma n i n  the  m iddle (the pro xy/ ro u t er/switc h)  can now lo g, redir ec t , oreven t amperwith al l of your t raff ic. 
Message- lev el encrypt io nw ould g uara nt ee tha t them essa g e  remains encrypt ed, e v e n dur i ngthese  i ntermed i ate"hops" whe re the traf fic it self  is d ecrypte d. 
Load- bal an cing is an o ther good  exam ple, be ca usethe  SSL c erti f i cateis g en era lly insta l l ed on  t h e l oadbalan ce r, w hich repr e sents th e S S L endpo in t.T he loa d  b a l ancer is t hen  resp o n sible for
 the_case of_SSL interception.
Generally, if you_have an_SSL_encrypted connection_to_a server, you_can trust that_you "really are* connected_to that server,_and_that the server's owners have identified themselves unambiguously to a mutually trusted third party,_like_Verisign, Entrust,_or_Thawte_(by presenting credentials identifying their_name, address, contact information, ability_to do_business, etc., and receiving a certificate countersigned by_the_third party's signature)._Using SSL, this certificate is an assurance to the_end user that traffic between the_user's browser (client)_and_the_server's SSL endpoint (which_may not be the server itself,_but some switch, router, or load-balancer_where the SSL certificate is installed) is_secure.  Anyone intercepting that traffic_gets gobbledygook and if they_tamper with_it in any way, then_the traffic is_rejected by_the server.
But SSL_interception is becoming common in many_companies.  With_SSL interception, you "ask" for an_HTTPS_connection to (for_example)_www.google.com,_the company's_switch/router/proxy hands you_a_valid certificate_naming_www.google.com as the endpoint (so your_browser_doesn't complain about a name mismatch), but_instead of being countersigned_by_a mutually trusted third_party, it is countersigned by_their own certificate authority (operating somewhere_in the_company), which_also happens to be trusted by your browser (since it's in_your trusted root CA list which_the company has control_over).
The company's_proxy_then establishes a_separate_SSL-encrypted connection_to your target site (in this example,_www.google.com), but_the proxy/switch/router in the middle is_now capable of logging_all_of your traffic.
You still see a_lock icon in your browser, since_the traffic is encrypted up_to_your_company's inner SSL endpoint using_their own certificate, and the traffic_is re-encrypted from_that endpoint to your final destination using_the_destination's SSL certificate, but the man_in_the middle (the proxy/router/switch) can now_log,_redirect,_or even tamper with all_of your traffic.
Message-level encryption would guarantee_that the message remains encrypted, even during these intermediate_"hops" where the_traffic itself is decrypted.
Load-balancing is_another_good_example, because the SSL certificate is generally installed on the_load balancer,_which represents the_SSL endpoint.  The load balancer is then responsible for