Internet Access TLS inspection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 60e9634 · +9 −4 lines · also on GitHub
⋯ 62 unchanged lines
6363
|AES256-SHA |
6464
## Known limitations
6565
TLS inspection has the following known limitations:
66
−- When a TLS inspection rule is enabled, all categories except Education, Government, Finance, and Health and Medicine are decrypted by default. Additionally, Global Secure Access manages a system bypass list that includes common destinations known to be incompatible with TLS inspection. If a request matches the system bypass, the TLS action is logged as Bypassed. Work is underway to support custom TLS rules for intercepting or bypassing specific destinations or categories. In the meantime, use the custom bypass feature in the Internet Access forwarding profile to exclude destinations that TLS inspection affects.
67
−- Make sure each certificate signing request (CSR) you generate has a unique certificate name and isn't reused. The signed certificate must stay valid for at least one year.
66
+- TLS inspection supports up to 100 policies, 1000 rules and 8000 destinations
67
+- Make sure each certificate signing request (CSR) you generate has a unique certificate name and isn't reused. The signed certificate must stay valid for at least 6 months.
6868
- You can use only one active certificate at a time.
6969
- TLS inspection doesn't support Application-Layer Protocol Negotiation (ALPN) version 2. If a destination site requires HTTP/2, the upstream TLS handshake fails, and the site isn't accessible when TLS inspection is enabled.
7070
- TLS inspection doesn't follow Authority Information Access (AIA) and Online Certificate Status Protocol (OCSP) links when validating destination certificates.
7171
## Mobile platform
72
−- Many mobile applications implement certificate pinning, which prevents successful TLS inspection and can lead to app failures. As a result, there is limited support for TLS inspection on mobile platforms. At this time, we recommend enabling TLS inspection for the Windows platform only
72
+- Many mobile applications implement certificate pinning, which prevents successful TLS inspection, resulting in handshake failures or loss of functionality. To reduce risk, enable TLS inspection in a test environment first and validate that critical applications are compatible. For apps that rely on certificate pinning, configure TLS inspection custom rules to bypass these destinations using domain-based or category-based rules.
7373
7474
## Related content
7575
76
−* [Configure Transport Layer Security](how-to-transport-layer-security.md)
76
+* [Configure Transport Layer Security Policies](how-to-transport-layer-security.md)
77
+
78
+* [Configure TLS settings](how-to-configure-tls-settings.md)
79
+
7780
* [Frequently asked questions for Transport Layer Security inspection](faq-transport-layer-security.yml)
81
+
82
+* [Troubleshooting guide for Transport Layer Security inspection](troubleshoot-transport-layer-security.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.