Security measures are applied to encrypted data exchanges by enabling content decryption, rule application, and content re-
encryption at a network location. A
certificate, self-signed or authenticated by an official
Certificate Authority is obtained for and installed within the secure proxy apparatus. A link to a secure page is replaced with a link to a page having a
fully qualified domain name of the proxy apparatus as the suffix. An encrypted session between the
client is established between the
client and the proxy apparatus without deceit in the later case. A first
encryption-enabled connection is established from the first node to a content filter, while a second
encryption-enabled connection is established from the content filter to the second node. Following decryption, a determination is made as to whether the content includes Undesired Data. Restricted material is blocked, while unrestricted material is re-encrypted and delivered to the destination node. For a self-signed
certificate, the destination node comprises a private
security system-signed
root certificate installed in the destination node's Trusted Root Certification Authorities
certificate store. In another aspect of the invention, at least one of encrypted Instant Messages, e-mail messages and web pages are decrypted and recorded at a location between sources and destinations of the transmissions. The
look and feel is maintained of a single encrypted link between the requestor and the
external source by the inventive use of a wildcard certificate within the network local to the requestor.