Internet Access Features That Require Decryption
The following features require decryption or do not work effectively on encrypted traffic:
- Intrusion prevention (IPS) for traffic to internet destinations.
Traffic must be decrypted to inspect HTTPS traffic for known threats and behaviors.
- Security features configured in security profiles.
Decryption is required for inspection by the security and acceptable use features. The security profile specified in any internet access rule should have decryption enabled, unless the destinations are trusted.
- File inspection and analysis and enforcement of file type controls.
See Manage File Inspection and File Analysis and Manage File Type Control.
- Destinations that are derived from SAML configurations
- Remote browser isolation (RBI).
If you choose Isolate as the rule action in an internet access rule, affected traffic must be decrypted. Enable decryption in the security profile that you choose for that rule.
- Displaying block and warning notifications to end users
When a destination triggers a warning page, users can only access that destination by clicking the link in the warning notification. See Manage Notification Pages for more information.
- Tenant Controls
- Advanced Application Controls.
- Data Loss Prevention
Sites that use HTTP rather than HTTPS do not require decryption to benefit from the functionality listed above. However, most sites use HTTPS. Enforcement based on threat categories never requires decryption.