A network monitoring device including: a communication acquiring unit which acquires communication before the communication reaches an opposite party's terminal; a protocol analyzing unit which identifies a message for session establishment by analyzing a protocol of the acquired communication, the message being included in the communication and including a digital certificate of a communication partner in a session to be kept confidential; a certificate extracting unit which extracts a digital certificate from the identified message for session establishment; and an inspecting unit which inspects the extracted digital certificate.