Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance. Use when configureing ssl/tls inspection on network security devices to decrypt, inspect,.
Configure SSL/TLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance. Use when configureing ssl/tls inspection on network security devices to decrypt, inspect,.
SSL/TLS inspection (also called SSL decryption, HTTPS inspection, or TLS break-and-inspect) intercepts encrypted traffic between clients and servers to inspect the cleartext content for malware, data exfiltration, policy violations, and command-and-control communications. The inspection device acts as a trusted man-in-the-middle, terminating the TLS session from the client, inspecting the plaintext content, and establishing a new TLS session to the destination server. With over 95% of web traffic now encrypted, organizations without TLS inspection have a massive blind spot. This skill covers configuring TLS inspection on next-generation firewalls, deploying trusted CA certificates, managing exemptions for certificate-pinned applications, and ensuring compliance with privacy regulations.
When to Use
Trigger phrases:
"performing ssl tls inspection configuration"
"Configure SSL/TLS inspection on network security devices to decrypt, inspect, an"
When conducting security assessments that involve performing ssl tls inspection configuration
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Next-generation firewall or secure web gateway with TLS inspection capability
Internal Certificate Authority (CA) for signing inspection certificates
Endpoint certificate management (GPO, MDM, or manual deployment)
Privacy and legal review for TLS inspection scope
Understanding of PKI, X.509 certificates, and TLS handshake
Core Concepts
This section covers core concepts for performing ssl tls inspection configuration.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
# Import CA certificate to firewall
# Device > Certificate Management > Certificates > Import
# Set as Forward Trust CA
set shared certificate SSL-Inspect-CA forward-trust-certificate yes
# Create Decryption Profile
set profiles decryption Corporate-Decrypt ssl-forward-proxy block-expired-certificate yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy block-untrusted-issuer yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy block-unknown-cert yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy restrict-cert-exts yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy strip-alpn no
# Minimum TLS version
set profiles decryption Corporate-Decrypt ssl-protocol-settings min-version tls1-2
set profiles decryption Corporate-Decrypt ssl-protocol-settings max-version max
# Decryption policy - decrypt outbound HTTPS
set rulebase decryption rules Decrypt-Outbound from Trust to Untrust
set rulebase decryption rules Decrypt-Outbound source any
set rulebase decryption rules Decrypt-Outbound destination any
set rulebase decryption rules Decrypt-Outbound service any
set rulebase decryption rules Decrypt-Outbound action decrypt
set rulebase decryption rules Decrypt-Outbound type ssl-forward-proxy
set rulebase decryption rules Decrypt-Outbound profile Corporate-Decrypt
Step 4: Configure Exemptions
Certain applications and categories must be excluded from TLS inspection:
# Exempt certificate-pinned applications
set rulebase decryption rules No-Decrypt-Pinned from Trust to Untrust
set rulebase decryption rules No-Decrypt-Pinned application [ apple-update microsoft-update dropbox-base ]
set rulebase decryption rules No-Decrypt-Pinned action no-decrypt
# Exempt privacy-sensitive categories
set rulebase decryption rules No-Decrypt-Privacy from Trust to Untrust
set rulebase decryption rules No-Decrypt-Privacy category [ health-and-medicine financial-services ]
set rulebase decryption rules No-Decrypt-Privacy action no-decrypt
# Exempt specific high-trust domains
set rulebase decryption rules No-Decrypt-Trusted from Trust to Untrust
set rulebase decryption rules No-Decrypt-Trusted destination [ bank-of-america.com chase.com healthcare.gov ]
set rulebase decryption rules No-Decrypt-Trusted action no-decrypt
Step 5: Configure Inbound Inspection for Internal Servers
# Import server certificate and private key
# Device > Certificate Management > Certificates > Import
# Inbound inspection policy
set rulebase decryption rules Inspect-WebServers from Untrust to DMZ
set rulebase decryption rules Inspect-WebServers destination [ 10.0.20.10 10.0.20.11 ]
set rulebase decryption rules Inspect-WebServers service service-https
set rulebase decryption rules Inspect-WebServers action decrypt
set rulebase decryption rules Inspect-WebServers type ssl-inbound-inspection
set rulebase decryption rules Inspect-WebServers profile Corporate-Decrypt
Step 6: Validate SSL Inspection
# Test from client - verify certificate issuer is internal CA
openssl s_client -connect www.google.com:443 -servername www.google.com 2>/dev/null | \
openssl x509 -noout -issuer -subject
# Expected output (with inspection active):# issuer= /C=US/O=Corp Inc/OU=Network Security/CN=Corp SSL Inspection CA# subject= /CN=www.google.com# Verify no certificate errors in browser# Check firewall decryption logs for errors# Test with curl
curl -v https://www.example.com 2>&1 | grep "issuer"# Check decryption statistics on firewall
show system setting ssl-decrypt memory
show system setting ssl-decrypt certificate-cache
show counter global filter category ssl
