HTTPS inspection lets a security gateway decrypt web traffic so it can evaluate the contents, then encrypt it again for delivery. Enable it where that inspection serves an approved security purpose and the applications support it. Allow a documented exception where confidentiality requirements or technical constraints justify the lost visibility. If the business cannot accept an uninspected connection, deny it or choose another approved workflow.
For an IT manager planning web protection, those are three distinct decisions: inspect, allow without decryption, or deny. Inability to decrypt is a constraint to evaluate before granting access.
Decide what the gateway needs to see
Transport Layer Security (TLS) protects HTTPS communications. An inspecting proxy creates separate client-to-proxy and proxy-to-server connections, making plaintext available at the proxy. Network Box USA's SSL proxying paper explains that architecture; it is a historical reference, not current configuration guidance.
This changes who must be trusted with the contents. The UK's National Cyber Security Centre discusses the tradeoff in section 2.3.2 of its Zero Trust Network Access guidance: inspection concentrates trust in the intermediary, and its security benefit should be weighed against privacy and operational implications. It also identifies endpoint, Domain Name System (DNS) and application controls as alternatives for some objectives.
Start with the intended result. Scanning a web download for malicious content requires access to that content. Blocking a known unwanted destination may be possible without decrypting the downloaded file. The available destination signals depend on the traffic path, protocols and product, so confirm what the deployed gateway actually observes.
| Decision | When it fits | Consequence to accept |
|---|---|---|
| Inspect | The business authorizes content inspection, needs it for the stated control, and the application supports the design. | The gateway can process plaintext and becomes part of the trusted handling path. |
| Allow without decryption | The connection is approved, but an agreed confidentiality or compatibility requirement excludes content inspection. | The gateway cannot scan the encrypted contents. Identify which other controls remain effective. |
| Deny or replace the workflow | The proposed connection is unapproved, or required inspection cannot be provided and the remaining risk is unacceptable. | The business needs a permitted alternative before relying on that workflow. |
Network Box USA's Managed Secure Web Gateway service combines HTTPS inspection, web-address (URL) and content policy, malware defense, and reporting. Its managed deployment includes validating traffic, testing policy behavior and resolving exceptions. That work helps turn these decisions into an operating policy, with the supported clients, matching conditions and coverage agreed during service design.
Distinguish certificate pinning from missing trust
A client must accept the certificate used by an inspecting proxy. Some applications also pin a particular certificate or public key. Android's certificate-pinning documentation, for example, describes requiring a certificate chain to contain a configured public key. A substitute chain can fail that check even when its issuing authority is otherwise trusted.
That is different from a managed browser simply missing the approved inspection certificate. Have the application supplier and gateway operator establish the actual cause. A browser trust-deployment problem calls for correcting that deployment; a confirmed pinning constraint calls for a supported application design or an explicit exception decision. Do not ask employees to dismiss certificate warnings or disable validation to make the test pass.
Apply the choices to one business workflow
Consider Harbor Print, a hypothetical commercial printer. Its IT manager, Leo, is introducing managed web protection. Staff download artwork through approved browser portals, while a desktop proofing application connects to a supplier service.
For this example, assume the supplier confirms that the proofing application uses certificate pinning and documents a dedicated service hostname. Assume the gateway can limit a no-decryption exception to that hostname and the designated print workstations. The proposed policy depends on confirming both conditions.
Leo's proposed policy keeps the approved browser downloads under content inspection. It permits the proofing connection without decryption only for the defined workstations and destination. The supplier application and endpoint controls retain their respective responsibilities; the exception record explicitly says that the gateway will not inspect the proofing contents.
A request to exempt the supplier's entire domain would widen the decision to other services. Leo instead asks whether the documented hostname and required supporting connections are sufficient. If they are not, the team reviews each additional dependency before expanding the exception.
Nor should the brief promise to exempt only one page or upload path inside an otherwise encrypted connection. The HTTPS definition in RFC 9110 protects the HTTP communication, including its requests. A gateway without decryption access cannot directly read that encrypted path. Confirm the identifiers available for enforcement, especially when a hostname serves several functions.
An employee also proposes an unrelated file-transfer service that cannot meet the company's inspection requirement. Leo declines the connection and keeps the existing approved transfer route.
Approve the handling and the failure behavior
Before rollout, agree which information may be decrypted, who can access inspection records, what is retained, and how exceptions are reviewed. Agree what diagnostic content, if any, may be stored. The OWASP logging guidance recommends excluding or appropriately protecting passwords, access tokens and sensitive personal information. Apply a defined collection policy to inspection logs and diagnostic captures.
In Harbor Print's pilot, use harmless artwork to test the normal browser download and the proofing transaction. Confirm the intended inspection decision for each, and test that the exception does not extend to unrelated workstations or destinations. Agree what happens if the inspection service is unavailable; an automatic uninspected fallback changes the policy just as an explicit exception does.
The customer approves business access, privacy requirements and the risk left by exceptions. The application and endpoint owners maintain their parts of the trust and compatibility design; the managed web operator implements and reviews the agreed gateway scope. To plan that scope, contact our team with the applications, user groups and inspection outcomes you need. Bring a description of sensitive workflows rather than their contents.