Internet Access TLS inspection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit d126fd3 · +1 −1 lines · also on GitHub
⋯ 59 unchanged lines
6060
- TLS inspection supports up to 100 policies, 1000 rules, and 8000 destinations.
6161
- Make sure each certificate signing request (CSR) you generate has a unique certificate name and isn't reused. The signed certificate must stay valid for at least 6 months.
6262
- You can use only one active certificate at a time.
63
−- TLS inspection doesn't support Application-Layer Protocol Negotiation (ALPN) version 2. If a destination site requires HTTP/2, the upstream TLS handshake fails, and the site isn't accessible when TLS inspection is enabled.
63
+- TLS inspection doesn't support HTTP/2 negotiation. Most sites automatically fall back to HTTP/1.1 and continue to work, but sites that require HTTP/2 won't load under inspection. If you encounter one of these, add a custom TLS bypass rule to allow access.
6464
- TLS inspection doesn't follow Authority Information Access (AIA) and Online Certificate Status Protocol (OCSP) links when validating destination certificates.
6565
## Mobile platform
6666
- Many mobile applications implement certificate pinning, which prevents successful TLS inspection, resulting in handshake failures or loss of functionality. To reduce risk, enable TLS inspection in a test environment first and validate that critical applications are compatible. For apps that rely on certificate pinning, configure TLS inspection custom rules to bypass these destinations using domain-based or category-based rules.
⋯ 8 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:39 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.