zlacker

But the traffic is totally understandable -- the right action does not require knowing what TLS 1.3 is.

The way it is supposed to work is as following: there is a protocol negotiation when the connection is established (which is obviously unencrypted), which contains TLS version supported. If MITM proxy does not understand the version, it can just change these bytes to force hosts to negotiate at a lower version.

So the only reason BlueCoat fails is because the authors failed to implement force version downgrade.