SSL Inspection

Overview

Encrypted HTTPS traffic conceals malicious payloads, phishing attempts, and data leakage, bypassing traditional perimeter security. Enterprises need visibility into this traffic for enforcing web usage policies, malware scanning, and preventing data exfiltration. At the same time, privacy-sensitive domains (e.g., banking and healthcare) must remain uninspected to comply with regulations like GDPR and HIPAA.

SafeSquid enables deep inspection of HTTPS traffic with minimal administrative overhead and no end-user disruption. It supports Zero-Trust architecture, granular policy-based bypass, and real-time threat prevention, delivering:

• Comprehensive visibility into encrypted sessions.
• Seamless user experience without certificate errors.
• Granular control over bypass policies for compliance.
• Enhanced security posture with contextual intelligence.

How SafeSquid SSL Inspection Works

1. SafeSquid intercepts HTTPS CONNECT requests and establishes dual SSL tunnels:

   • Client ⇌ SafeSquid (using SafeSquid-generated certificate)
   • SafeSquid ⇌ Destination Server (using server's actual certificate)

2. Decrypts data streams to enforce security policies:

   • Malware scanning
   • Data Loss Prevention (DLP)
   • URL filtering and access control

3. Re-encrypts and forwards traffic back to clients.

4. Key features include:

   • On-the-fly TLS/SSL decryption.
   • Real-time SSL certificate validation and chain repair.
   • SNI-aware transparent proxying.

Prerequisites

Client-Side Preparations

• Deploy SafeSquid Root CA certificate to all client systems and browsers.
• Update endpoint security solutions to trust SafeSquid's MITM certificates.
• Verify compatibility with applications enforcing SSL pinning.

SafeSquid-Side Preparations

• Generate or import enterprise-approved Root CA certificates.
• Configure Trusted Root CA store for validating upstream certificates.
• Prepare role-based policies for bypassing sensitive domains and services.

Configuring HTTPS Inspection

Generating SSL Certificates

Access the Self-Service Portal

Log in to the Self-Service Portal - https://key.safesquid.com 

The Self-Service Portal for managing your SafeSquid deployments, facilitates easy creation of Trusted Root CA Certificates. 

 

 

Generate SafeSquid Certificate

Using Self-Signed Certificate. 

note

When you see the "Generate" button it means that SafeSquid's SSL certificate has not been generated yet. 

 

Note: The passphrase entered in step #3 is non-recoverable. Remember to save the passphrase if in case you want to reuse the same certificate with a different activation key. 

Using Enterprise CA Certificate 

With a Passphrase

Generating SafeSquid certificate using an enterprise CA certificate which has a passphrase. 

 

 

 

 

 

Without a Passphrase

 

Note: The passphrase entered in step #6 is non-recoverable. Remember to save the passphrase if in case you want to reuse the same certificate with a different activation key. 

 

 

Download Certificate

From the Self-Service Portal 

Enabling SSL Inspection

Access the SafeSquid interface 

Go to Configure Page 

 

Open Real time content security side menu

 

Open HTTPS Inspection section

 

Enable HTTPS Inspection

Note: In newer versions of SafeSquid which are released after June-2017, setup tab is removed. You will see only three subsections in HTTPS inspection section. 

 

Open Global part of HTTPS Inspection section and make the Enabled as True.

  

  Open Inspection Policies Tab

Make sure all the policies should be Enabled as True. 

  

 

 

 

Save Configuration

Click on Save Configuration icon situated at bottom left corner. 

 

When you click on Save config, it will give a prompt for asking the confirmation to store your configuration into the cloud.  

• Select Yes only in below cases: 

  • If you want to use this same configuration in other SafeSquid instances. 

  • If your total configuration in all sections is completed and validated.  

• Otherwise, select No and click on submit 

Bypass Inspection

To bypass HTTPS Inspection enabled SafeSquid default configuration, follow the below steps:

Access the SafeSquid User Interface

 

 

Search policy: "BYPASS SSL INSPECTION" to Search

 

Edit policy to Enable as TRUE (Inspection Policies)

 

 

 

**Edit policies and profiles to Enable as TRUE **

 

**How to create new policy to bypass HTTPS Inspection **

 

**Go to Request Types **

 

 

 

 

 

 

**Go to Access Policies **

 

 

 

note

Configure Proxy settings in drop box and upload/download files to validate the working