How to know if your company does TLS intercept
As the post you linked to explains, the proxy will decrypt all the traffic, and then encrypt it again but signed with another certificate. Therefore the certificate you receive will be different from the one the website send. So one way to detect this is to compare the certificates you get when you visit a website from your company network with the one you get when you visit it from outside of that network (e.g. from home).
All browsers have functionality to view the thumbprint of a certificate. In Chrome, click the green lock in the URL bar, then click "Info", and finally "View certificate".
Some caveats, though:
- Some websites may serve different certificates to different users for various reasons, so that they don't match for one site might not be enough to conclude there is a TLS proxy.
- The proxy might not intercept traffic for all domains, so even if all the certificates you try match it is impossible to know that your traffic will never be intercepted.
So how do you get around those caveats? You would have to go through the trust store in your OS and your browser (if it uses it's own) to see if any certificates have been added there. For instructions on how to do this, see this question.
Finally, it should be noted that TSL interception is a perfectly legitimate thing for an employer to do. And since you are probably using a computer provided to you by your employer at work, there are many other ways they could monitor your browsing habits and anything else you do on your computer without relying on a proxy server. So if you want privacy, don't use your work computer or network.
But what about the ISP?
While your employer might have legitimate reasons to do this, your ISP most certainly does not. Fortunately, they can not easily do this. Why? The answer is in your quote:
If your company has set up the proxy correctly you won't know anything is off because they'll have arranged to have the proxy's internal SSL certificate registered on your machine as a valid certificate. If not, you'll receive a pop-up error message, which, if you click on to continue, will accept the "fake" digital certificate.
Since your ISP does not control your computer, there is no way for them to install a root certificate (other than making you do it). So you would get a warning that the certificate is incorrect every time you visit a site over HTTPS. Not very stealthy in other words.
If you are still concerned someone might have sneaked a root certificate into your trust store, you could used the method above to check. But you would need to compare the certificates you get from the ones from a computer with another ISP, preferably even in another country. Or you could just compare them to the preloaded public key pins for sites that use HPKP.
