Unless I'm missing something, this is not possible (unless you install a certificate root supplied by your employer) because any man-in-the-image attempt would be flagged as a failed certificate authentication. Indeed, that's exactly why certificate chains tied to domain names exist.
They can however look at your DNS queries, and even if you use encrypted DNS they can still inspect the certificates of sites you are going to to figure out what the domain is.
In the past it was possible to quickly swap the physical sata hard disk on some laptops to segregate work/personal use, but that's no longer viable with modern laptops.
On the plus side carrying 2 modern laptops weighs the same as one oldshool laptop and they use the same usb-c charger...
Be careful with this. My MacBook Air will charge off anything, including a 5V battery bank. My Dell won’t charge off anything less than 18V over USB-C.
Got caught in a bind once when I brought my “slow” charger thinking that would be fine for light use on a trip away. It was not.
Many of these corporate inspection tools seem to leave traffic on nonstandard ports alone by the way, just saying ;)
Of course they’d lose their ability to issue public certificates if it became widely known, but they have it within their power.
Monitoring the connection of an employee (which is different from blocking certain domains) is possible under certain conditions, but always at the individual level and when there is a reasonable suspicion that the employee might be misbehaving: https://www.laleggepertutti.it/507663_controllo-navigazione-...
You mean your big enough that legal answered "In the unlikely event that an employee knows their rights, we can afford to get sued"?
I second that this is immensely illegal in Germany.
If your corporate instructions for using the "guest" wifi include registering devices and adding trusted certificates, your device usage is being monitored and associated with you personally and your SSL connections are probably getting MITM'd.