Prove HTTPS Is Inspected, Not Tunnelled
An HTTPS site that loads through the proxy proves nothing about inspection. SafeSquid can tunnel the session untouched and the page still renders perfectly — so the control appears to work while malware scanning, DLP, and content policy see nothing but an opaque stream.
The certificate issuer is the only reliable positive test. Everything else is a page that loaded.
Validate prerequisites
Confirm:
- Proxy Connectivity passes for plain HTTP.
- The SafeSquid Root CA has been deployed to the pilot client’s trust store, if inspection is enabled.
- The intended inspection scope is documented, including any destinations deliberately excluded.
- A rollback path exists for the client trust store.
Request an HTTPS site through the proxy
From the pilot client:
Expected result: the connection succeeds or fails with a known certificate-trust condition that matches the current SSL inspection stage.
Check the access log on the SafeSquid server:
Expected result: the log records the HTTPS destination and policy action.
TLS warning risk: A browser certificate warning is not a successful production HTTPS inspection test. It is evidence that endpoint trust, SSL policy, or the test path still needs review.
Read the certificate issuer
Once SSL inspection is configured and the Root CA is deployed, the positive test is the certificate itself. Load an HTTPS site in the pilot browser and inspect the certificate issuer.
Expected result: the issuer is the SafeSquid CA, and no warning appears.
An issuer showing the original site’s certificate authority means the connection is being tunnelled rather than inspected, even though the page loads normally. That is the failure this page exists to catch.
Check an excluded destination too. A destination on the bypass list should show its original issuer — if it shows the SafeSquid CA, the exclusion is not matching, and traffic the business agreed not to decrypt is being decrypted.
Capture inspection evidence
Store these artifacts with the deployment record:
- Certificate issuer for an inspected destination, showing the SafeSquid CA.
- Certificate issuer for an excluded destination, showing the original CA.
- The matching access-log entries for both.
- The documented inspection scope, with the business owner of each exclusion.
- Root CA rollout evidence for the pilot client.
Troubleshoot inspection failures
Next steps
