@thedarktangent I use squid proxy with a default deny policy. Adding "dstdomain" entries to an allow list. Machines that need that inspection get an egress firewall rule (or reduced routing, or both) so all they can do is use the proxy.

I do not do SSL inspection at any site I do this for.

Target application has to support using an http proxy though.