Skip to main content

​
Prove HTTPS Is Inspected, Not Tunnelled

An HTTPS site that loads through the proxy proves nothing about inspection. SafeSquid can tunnel the session untouched and the page still renders perfectly. The control appears to work while malware scanning, DLP, and content policy see nothing but an opaque stream. The certificate issuer is the only reliable positive test. Everything else is a page that loaded.

​
Validate prerequisites

Confirm:
  • Proxy Connectivity passes for plain HTTP.
  • The SafeSquid Root CA has been deployed to the pilot client’s trust store, if inspection is enabled.
  • The intended inspection scope is documented, including any destinations deliberately excluded.
  • A rollback path exists for the client trust store.

​
Request an HTTPS site through the proxy

From the pilot client:
Expected result: the connection succeeds or fails with a known certificate-trust condition that matches the current SSL inspection stage. Check the access log on the SafeSquid server:
Expected result: the log records the HTTPS destination and policy action.
TLS warning risk: A browser certificate warning is not a successful production HTTPS inspection test. It is evidence that endpoint trust, SSL policy, or the test path still needs review.
If SSL inspection is not configured yet, do not normalise browser certificate-warning bypasses for production users. Limit any warning bypass to an isolated pilot test and record it in the change evidence. Complete Root CA deployment before production HTTPS inspection.

​
Read the certificate issuer

Once SSL inspection is configured and the Root CA is deployed, the positive test is the certificate itself. Load an HTTPS site in the pilot browser and inspect the certificate issuer. Expected result: the issuer is the SafeSquid CA, and no warning appears. An issuer showing the original site’s certificate authority means the connection is tunnelled rather than inspected. The page still loads normally. That is the failure this page exists to catch. Check an excluded destination too. A destination on the bypass list should show its original issuer. If it shows the SafeSquid CA, the exclusion is not matching. Traffic the business agreed not to decrypt is being decrypted.

​
Capture inspection evidence

Store these artifacts with the deployment record:
  • Certificate issuer for an inspected destination, showing the SafeSquid CA.
  • Certificate issuer for an excluded destination, showing the original CA.
  • The matching access-log entries for both.
  • The documented inspection scope, with the business owner of each exclusion.
  • Root CA rollout evidence for the pilot client.

​
Troubleshoot inspection failures

​
Next steps