I just realized that SSL man-in-the-middle attacks are far more common than I thought, especially in corporate environments. I've heard about and seen myself several enterprises which have a transparent SSL proxy server in place. All clients are configured to trust this proxy's certificate. This basically means that the employer theoretically can intercept even SSL encrypted traffic without any warnings in the browser popping up. As mentioned above, the clients come with the certificate being trusted. This can only be revealed by manually validating the certificate which is being used.
To me, it appears as if the employer utilizes his superior position to spy on the employee's SSL traffic. For me, this renders the whole concept of SSL untrustworthy. I have successfully tested a similar setup myself using mitmproxy and was able to read the communication between client and my electronic banking server. This is information that shouldn't be revealed to anybody.
Thus, my question is rather simple: How can I validate the chain of trust on server side? I want to make sure the client uses my server's certificate and only one chain of trust. I wonder if this can be achieved by Apache's SSL configuration? This would be convenient as it could be applied to many applications easily. If this is not possible, does anyone know of a way to do this in PHP? Or do you have any other suggestions?