Internet Access TLS inspection FAQ
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 60e9634 · +2 −33 lines · also on GitHub
⋯ 30 unchanged lines
3131
- Configure Conditional Access: Create a Conditional Access policy and associate it with the Global Secure Access security profile linked to the TLS policy.
3232
- Distribute the trusted certificate: Ensure the selected certificate authority is installed on all client devices to establish trust and enable seamless TLS inspection.
3333
34
− - question: What are the cryptographic algorithms required when generating Certificates for TLS inspection?
34
+ - question: What are the cryptographic algorithms supported when generating Certificates for TLS inspection?
3535
answer: Global Secure Access currently supports SHA-256, SHA-384, and SHA-512 for the signing certificates.
3636
3737
- question: How do I Sign CSR Using the Active Directory Certificate Services (AD CS)
⋯ 3 unchanged lines
4141
```cmd
4242
certreq -submit -attrib "CertificateTemplate:SubCA" "C:\pathtoyourCSR\tlsca.csr" "tlsca.cer"
4343
```
44
− - question: Why do I receive the error "SSL certificate problem unable to get local issuer certificate" when using Git?
45
− answer: |
46
− This error occurs because certain developer tools (such as Git) don't use the operating system's certificate store by default; instead, they maintain their own certificate store.
47
− You may direct git to use windows' certificate store:
48
− ```cmd
49
− git config --global http.sslbackend schannel
50
− ```
51
− or to append the certificate to Git's Certificate Authority bundle.
52
− The following PowerShell script demonstrates how to add the certificate to Git's CA bundle on a Windows system.
53
− ```powershell
54
− # Define the path to your custom root Certificate Authorities
55
− $certPath = "./myTLSInspectionRootCA.crt"
56
− # Verify the certificate file exists
57
− if (-Not (Test-Path $certPath)) {
58
− Write-Host "Certificate file not found at $certPath"
59
− exit 1
60
− }
61
− # --- Git Configuration ---
62
− $gitCAPath = git config --get http.sslcainfo
63
− if ($gitCAPath) {
64
− try {
65
− Get-Content $certPath | Add-Content -Path $gitCAPath
66
− Write-Host "Certificate appended to Git CA bundle at $gitCAPath"
67
− } catch {
68
− Write-Host "Failed to append certificate to Git CA bundle $_"
69
− }
70
− } else {
71
− Write-Host "Git CA bundle path not found. Is Git installed and configured?"
72
− }
73
−
74
−
75
− ```
44
+
7645
- question: What is certificate pinning, and how does it affect TLS inspection?
7746
answer: |
7847
Certificate pinning is a security mechanism that restricts an application's TLS connections to a specific set of trusted certificates or public keys. Certificate pining ensures that the application only communicates with servers presenting those exact credentials, even if other certificates are valid and trusted by the system.
⋯ 23 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.