Exercise 3: Why the Browser Works and the Script Doesn't — Possible Solution ==================================================================== WHY THE BROWSER SUCCEEDS ------------------------------ Per this chapter, "the browser trusts the corporate network's own internal certificate authority, pushed out to every managed machine - so it sees the TLS-inspecting proxy's re-issued certificate as perfectly valid and never shows a problem." A transparent proxy is decrypting and re-encrypting the HTTPS traffic with its own internal certificate, and the browser already has that internal CA installed as trusted, so nothing looks wrong to it. WHY THE SCRIPT FAILS ------------------------------ Per this chapter, "the script's HTTP client, running with its own default trust store, has never heard of that internal CA, and correctly refuses to trust a certificate signed by an authority it doesn't recognize." The script is seeing the exact same re-issued certificate the browser sees, but without that internal CA already trusted, it correctly identifies the certificate as coming from an unrecognized issuer and refuses the connection. WHY THE FIX BELONGS TO THE SCRIPT'S ENVIRONMENT, NOT THE NETWORK ------------------------------ Per this chapter, "neither the API nor the network connection is actually broken; the fix belongs to the script's own environment - installing the corporate CA certificate into its trust store - not to anything on the network path itself." The network is working exactly as configured (the transparent proxy is functioning as intended); the only thing missing is the script's trust store not having the same certificate the browser already has. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains both outcomes using the same single underlying cause (the transparent TLS-inspecting proxy and each client's own trust store), rather than treating the browser's success and the script's failure as two separate problems, and correctly places the fix in the script's environment rather than the network.