<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><span style="font-size: 12pt;">Good morning,</span><br></div><div data-marker="__QUOTED_TEXT__"><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><div>My question relates to ssl bumping and potentially Icap/Ecap functionality. I currently have ssl bump/ interception working and communicating with a local ICAP server. Im trying to understand the process of how the decrypted data gets sent to the ICAP server for analysis in things such as clamav etc. My goal is to have the decrypted traffic analyzed by Suricata preferably on a separate box if possible. </div><br><div><div>Best regards</div></div></div></div></div><br></div></div></body></html>