A method for controlling secure communications in a communications network comprising a client (102-X, 102-Y), one or more servers (104-A, 104-B) and an intermediate network element between the client (102-X, 102-Y) and the one or more servers (104-A, 104-B), the method comprising, at the intermediate network element, INE,: receiving a request from the client (102-X, 102-Y) to establish a secure connection between the client (102-X, 102-Y) and a first server (104-A, 104-B)); analysing the received request to determine a client identifier identifying the client (102-X, 102-Y) to the INE; determining based at least on the determined client identifier whether to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE; responsive to a determination not to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE, forwarding the received request on to a second server (104-A, 104-B); and responsive to a determination to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE, sending to the client (102-X, 102-Y), in response to the received request, a first message comprising information for the client (102-X, 102-Y) to use in establishing a secure connection with the INE responsive to a determination that the client (102-X, 102-Y) accepts the first message: establishing the first end-to-end secure connection between the INE and the client (102-X, 102-Y); and establishing a second end to end secure connection between the INE and the second server (104-A, 104-B); wherein determining whether to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE comprises determining whether the client adopts certificate pinning for the first server (104-A, 104-B). receiving a request from the client (102-X, 102-Y) to establish a secure connection between the client (102-X, 102-Y) and a first server (104-A, 104-B)); analysing the received request to determine a client identifier identifying the client (102-X, 102-Y) to the INE; determining based at least on the determined client identifier whether to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE; responsive to a determination not to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE, forwarding the received request on to a second server (104-A, 104-B); and responsive to a determination to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE, sending to the client (102-X, 102-Y), in response to the received request, a first message comprising information for the client (102-X, 102-Y) to use in establishing a secure connection with the INE responsive to a determination that the client (102-X, 102-Y) accepts the first message: establishing the first end-to-end secure connection between the INE and the client (102-X, 102-Y); and establishing a second end to end secure connection between the INE and the second server (104-A, 104-B); establishing the first end-to-end secure connection between the INE and the client (102-X, 102-Y); and establishing a second end to end secure connection between the INE and the second server (104-A, 104-B); wherein determining whether to attempt to establish a first end-to-end secure connection between the client (102-X, 102-Y) and the INE comprises determining whether the client adopts certificate pinning for the first server (104-A, 104-B).