Provided I have not set cache-control header to private, can ISPs cache web pages (by respecting max-age) served over HTTPS?
Sorry if I sound naive, but I wanted to know if ISPs somehow can cache and relay without intercepting/decrypting.
Webmasters Stack Exchange is a question and answer site for pro webmasters. It only takes a minute to sign up.Sign up to join this community
If they provide an HTTP proxy service you use, they can cache on the fly.
If they do not pervert the HTTPS stream (which starts by changing the server certificate exposed and/or changing the CAs you trust on your client device) they have no way to see the content, hence they have nothing to cache.
SSL/TLS is a transport encryption standard. It hides the entire communication between client and server. So decryption of the transport encryption* is a prerequisite to caching.
Intercepting SSL/TLS is something that does happen, but mostly on private networks or by ISPs in totalitarian regimes. It's not something that can really be done without users noticing as users will have to install a special root certificate on the client devices.
Another thing that increasingly happens for media content is that site owners partner with CDNs and those CDNs in turn place distribution servers into ISP networks. Since this happens with the approval and cooperation of the site operator, legitimate certificates can be presented.
* Of course there may be other layers of encryption, for example a TV stream may be encrypted by the DRM system, then encrypted again by the transport encryption.