Internet Access TLS inspection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit b1a62d0 · +6 −4 lines · also on GitHub
⋯ 3 unchanged lines
44
author: HULKsmashGithub
55
ms.author: jayrusso
66
ms.topic: concept-article
7
−ms.date: 05/28/2025
7
+ms.date: 03/09/2026
8
+ms.reviewer: sumeetmittal
89
910
#customer intent: As a Global Secure Access administrator, I want to learn about the Transport Layer Security (TLS) protocol to support the creation of TLS inspection policies.
1011
⋯ 25 unchanged lines
3637
3738
To get started with TLS inspection, see [Configure Transport Layer Security](how-to-transport-layer-security.md).
3839
39
−## Supported Cyphers
40
−|List of supported cyphers |
40
+## Supported ciphers
41
+|List of supported ciphers |
4142
|-------------------|
4243
|ECDHE-ECDSA-AES128-GCM-SHA256|
4344
|ECDHE-ECDSA-CHACHA20-POLY1305|
⋯ 16 unchanged lines
6061
- You can use only one active certificate at a time.
6162
- TLS inspection doesn't support HTTP/2 negotiation. Most sites automatically fall back to HTTP/1.1 and continue to work, but sites that require HTTP/2 won't load if TLS inspection is enabled. Add a custom TLS bypass rule to allow access to HTTP/2 only sites.
6263
- TLS inspection doesn't follow Authority Information Access (AIA) and Online Certificate Status Protocol (OCSP) links when validating destination certificates.
63
−## Mobile platform
64
+
65
+### Mobile platform
6466
- Many mobile applications implement certificate pinning, which prevents successful TLS inspection, resulting in handshake failures or loss of functionality. To reduce risk, enable TLS inspection in a test environment first and validate that critical applications are compatible. For apps that rely on certificate pinning, configure TLS inspection custom rules to bypass these destinations using domain-based or category-based rules.
6567
6668
## Related content
⋯ 6 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:39 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.