and you can still intercept all the SSL if you just roll out your own certs to all the workstations and the firewall opens everything..