Internet Access TLS inspection FAQ
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 24fb39c · +57 −17 lines · also on GitHub
⋯ 15 unchanged lines
1616
- name: Single section - ignored
1717
questions:
1818
- question: What is Transport Layer Security (TLS) inspection?
19
− answer: TLS inspection decrypts and analyzes encrypted network traffic to detect threats, enforce security policies, and prevent data exfiltration. Since most internet traffic is encrypted, inspecting network traffic is crucial for comprehensive security.
20
−
19
+ answer: |
20
+ TLS inspection decrypts and analyzes encrypted network traffic to help organizations detect threats, enforce security policies, and prevent data exfiltration. With the majority of internet traffic now encrypted,
21
+ TLS inspection provides visibility into data flows that would otherwise be opaque to security tools. TLS inspection enables enterprises to apply advanced protections such as content filtering without compromising
22
+ the confidentiality of legitimate communications.
23
+
2124
- question: How does TLS inspection work?
22
− answer: TLS inspection intercepts encrypted network traffic, decrypts it for security analysis, and re-encrypts it before sending it to its destination. To implement TLS inspection successfully, follow these best practices
23
− - Before you enable TLS inspection in a live environment, work with your organization's legal and privacy teams to draft a Terms of Use (ToU) policy for users.
24
− - Select a root certificate authority or intermediate certificate authority to sign the Certificate Signing Request (CSR) for Global Secure Access.
25
− - Set up a TLS policy that fits your organization's needs.
26
− - Create a Conditional Access policy and associate it with the Global Secure Access security profile that's linked to the TLS policy.
27
− - Make sure the root certificate authority or intermediate certificate authority is installed on all client devices to establish trust for TLS inspection.
25
+ answer: |
26
+ TLS inspection enables organizations to analyze encrypted network traffic by decrypting it for security inspection and re-encrypting it before forwarding it to its destination.
27
+ To implement TLS inspection effectively, consider the following operational best practices:
28
+ - Communicate clearly with users: Before enabling TLS inspection in a production environment, ensure users are informed about how encrypted traffic is handled. Many organizations choose to provide a Terms of Use (ToU) or similar notice.
29
+ - Select a certificate authority: Choose a root or intermediate certificate authority to sign the Certificate Signing Request (CSR) created by Global Secure Access for TLS inspection.
30
+ - Define a TLS policy: Configure a TLS inspection policy that aligns with your organization's security and operational requirements.
31
+ - Configure Conditional Access: Create a Conditional Access policy and associate it with the Global Secure Access security profile linked to the TLS policy.
32
+ - Distribute the trusted certificate: Ensure the selected certificate authority is installed on all client devices to establish trust and enable seamless TLS inspection.
2833
29
− - question: What are the cryptographic algorithms required when generating Certificates for TLS inspection?
34
+ - question: What are the cryptographic algorithms required when generating Certificates for TLS inspection?
3035
answer: Global Secure Access currently supports SHA-256, SHA-384, and SHA-512 for the signing certificates.
31
−
32
− - question: What is certificate pinning, and how does it affect TLS inspection?
33
− answer: Certificate pinning restricts an application's TLS connections to specific certificates. This restriction prevents interception, but it also blocks security solutions that rely on TLS inspection.
34
−
36
+
37
+ - question: How do I Sign CSR Using the Active Directory Certificate Services (AD CS)
38
+ answer: |
39
+ TLS inspection requires an intermediate certificate authority, ensure you are using the Subordinate CA template. To sign CSR generated from TLS settings,
40
+ you may use AD CS web enrollment UI or use the certreq command-line tool.
41
+ ```cmd
42
+ certreq -submit -attrib "CertificateTemplate:SubCA" "C:\pathtoyourCSR\tlsca.csr" "tlsca.cer"
43
+ ```
3544
- question: Why do I receive the error "SSL certificate problem unable to get local issuer certificate" when using Git?
3645
answer: |
37
− "This error occurs because certain developer tools (such as Git) do not use the operating system’s certificate store by default; instead, they maintain their own certificate store. One way to resolve this is to append the certificate to Git’s Certificate Authority bundle.
38
− The following PowerShell script demonstrates how to do this on a Windows system."
39
−
46
+ This error occurs because certain developer tools (such as Git) don't use the operating system's certificate store by default; instead, they maintain their own certificate store.
47
+ You may direct git to use windows' certificate store:
48
+ ```cmd
49
+ git config --global http.sslbackend schannel
50
+ ```
51
+ or to append the certificate to Git's Certificate Authority bundle.
52
+ The following PowerShell script demonstrates how to add the certificate to Git's CA bundle on a Windows system.
53
+ ```powershell
54
+ # Define the path to your custom root Certificate Authorities
55
+ $certPath = "./myTLSInspectionRootCA.crt"
56
+ # Verify the certificate file exists
57
+ if (-Not (Test-Path $certPath)) {
58
+ Write-Host "Certificate file not found at $certPath"
59
+ exit 1
60
+ }
61
+ # --- Git Configuration ---
62
+ $gitCAPath = git config --get http.sslcainfo
63
+ if ($gitCAPath) {
64
+ try {
65
+ Get-Content $certPath | Add-Content -Path $gitCAPath
66
+ Write-Host "Certificate appended to Git CA bundle at $gitCAPath"
67
+ } catch {
68
+ Write-Host "Failed to append certificate to Git CA bundle $_"
69
+ }
70
+ } else {
71
+ Write-Host "Git CA bundle path not found. Is Git installed and configured?"
72
+ }
73
+ ```
74
+ - question: What is certificate pinning, and how does it affect TLS inspection?
75
+ answer: |
76
+ Certificate pinning is a security mechanism that restricts an application's TLS connections to a specific set of trusted certificates or public keys. Certificate pining ensures that the application only communicates with servers presenting those exact credentials, even if other certificates are valid and trusted by the system.
77
+ This technique helps defend against man-in-the-middle (MITM) attacks by preventing unauthorized interception of encrypted traffic. However, it also interferes with network security tools that rely on TLS inspection, which works by decrypting and re-encrypting traffic using an intermediary certificate.
78
+
4079
- question: How should I handle applications that use certificate pinning?
41
− answer: The connection fails if TLS inspection terminates traffic from applications that use certificate pinning. To ensure your applications work as expected, create a custom bypass rule in the traffic forwarding profile to exclude traffic from these applications from Global Secure Access. You can perform this operation as part of custom bypass in the [Internet access forwarding profile](/mem/intune/protect/compliance-custom-script). We're working on custom TLS rules to let you acquire traffic and bypass TLS inspection only.
80
+ answer: |
81
+ The connection fails if TLS inspection terminates traffic from applications that use certificate pinning. To ensure your applications work as expected, create a custom bypass rule in the traffic forwarding profile to exclude traffic from these applications from Global Secure Access. You can perform this operation as part of custom bypass in the [Internet access forwarding profile](/mem/intune/protect/compliance-custom-script). We're working on custom TLS rules to let you acquire traffic and bypass TLS inspection only.
4282
4383
- question: Is TLS 1.3 supported?
4484
answer: Microsoft Entra TLS inspection enables TLS 1.2 and TLS 1.3 by default. The highest mutually supported version is selected for the session, from the client to Global Secure Access and from Global Secure Access to the destinations. Microsoft Entra doesn't support TLS 1.3 with Encrypted Client Hello (ECH) because the Server Name Indication (SNI) is encrypted, which prevents Global Secure Access from creating the corresponding leaf certificates for TLS termination.
⋯ 15 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.