SSL/TLS Inspection and Decryption Policies
Domain 6 covers HTTPS interception on the WSA: the appliance certificate authority, decryption policy actions, certificate validation, and the operational consequences of breaking TLS end to end. Expect scenario questions where a broken application must be exempted without disabling inspection globally.
Mechanics
- Enable the HTTPS Proxy on a port, then the WSA terminates client TLS and re-signs the connection with a certificate generated from the appliance CA (or an uploaded CA).
- Export the CA certificate and distribute it through GPO or MDM. Without trust, browsers throw warnings and pinned applications fail closed.
- Decryption policies match like access policies - identity, URL category, reputation, user agent - and the actions are Decrypt, Pass Through, or Drop.
- With Pass Through, the appliance still sees the SNI hostname and can categorize by domain, but not the path or content.
- Certificate validation options cover expired certificates, untrusted issuers, hostname mismatch, and revocation via OCSP/CRL; each condition is set to drop, decrypt, or pass through.
Worked example
Finance and health categories must not be decrypted for privacy, everything else should be decrypted, and a legacy application using certificate pinning breaks. Reasoning: create a decryption policy above the default that passes through the Financial and Health categories; add a custom category holding the pinned application's domains and pass it through as well. Order matters because the first matching policy wins. Verify in Policy Trace that the decision reads Decrypt for general traffic and Pass Through for the exceptions.
Traps that cost marks
- Forgetting to push the CA certificate, producing certificate errors that look like proxy failures.
- Expecting full URL filtering or AUP on HTTPS without decryption.
- Decrypting pinned or mutual-TLS applications, which fail with generic errors instead of block pages.
- Ignoring certificate validation settings, letting traffic to expired or revoked certificates through.
- Under-sizing CPU: decryption is the heaviest workload on the appliance.