A method for detecting encrypted content, wherein the method is applied to a communications network, the communications network comprises a middlebox network device, a key manager, and a server, the middlebox network device is located on a Transport Layer Security, TLS, secure channel established between a client and the server, and the method comprises: 1.1 obtaining, by the key manager, key information of the TLS secure channel; 1.2 sending, by the key manager, the key information to the middlebox network device by using a first secure channel, so that the middlebox network device decrypts, by using a session key corresponding to the key information, encrypted application data transmitted over the TLS secure channel, and detects decrypted application data, wherein the encrypted application data is generated by the client or the server by encrypting application data based on the session key, and the first secure channel is a secure channel established between the key manager and the middlebox network device;wherein the key information comprises a first random number, a second random number, a pre-master key, and a pseudo-random function, and the first random number, the second random number, the pre-master key, and the pseudo-random function are used for generating the session key of the TLS secure channel; and 1.3. wherein before the obtaining, by the key manager, key information of the TLS secure channel, the method further comprises: 1.3.1. receiving, by the key manager, a first key request message sent by the middlebox network device by using the first secure channel, wherein the first key request message comprises 5-tuple information of the TLS secure channel, the first key request message is used to request the key information, and the 5-tuple information comprises an Internet Protocol IP address of the client, a port number of the client, an IP address of the server, a port number of the server, and a transport layer protocol; andl.3.2. obtaining, by the key manager, key information of the TLS secure channel comprises: obtaining, by the key manager, the key information based on the 5-tuple information. 1.1 obtaining, by the key manager, key information of the TLS secure channel; 1.2 sending, by the key manager, the key information to the middlebox network device by using a first secure channel, so that the middlebox network device decrypts, by using a session key corresponding to the key information, encrypted application data transmitted over the TLS secure channel, and detects decrypted application data, wherein the encrypted application data is generated by the client or the server by encrypting application data based on the session key, and the first secure channel is a secure channel established between the key manager and the middlebox network device;wherein the key information comprises a first random number, a second random number, a pre-master key, and a pseudo-random function, and the first random number, the second random number, the pre-master key, and the pseudo-random function are used for generating the session key of the TLS secure channel; and 1.3. wherein before the obtaining, by the key manager, key information of the TLS secure channel, the method further comprises: 1.3.1. receiving, by the key manager, a first key request message sent by the middlebox network device by using the first secure channel, wherein the first key request message comprises 5-tuple information of the TLS secure channel, the first key request message is used to request the key information, and the 5-tuple information comprises an Internet Protocol IP address of the client, a port number of the client, an IP address of the server, a port number of the server, and a transport layer protocol; andl.3.2. obtaining, by the key manager, key information of the TLS secure channel comprises: obtaining, by the key manager, the key information based on the 5-tuple information.