​

Configure HTTPS Inspection

​

Prerequisites

• SafeSquid installed and licensed
• Access to Self-Service Portal (for certificate generation)
• Access to SafeSquid Configuration Portal (http://safesquid.cfg/—embedded Rest UI interface built into SafeSquid; accessible only when your client uses the proxy, but NOT resolved by SafeSquid’s DNS resolver—or https://SERVER-IP:8443/ for direct access)

• List of domains to bypass (banking, healthcare, SSL-pinned apps)
• Method to deploy Root CA to all clients (GPO, MDM, or manual)
• Administrative access to client systems (for certificate import)
• Pilot scope for rollout testing before enterprise-wide enablement

​

Why this preparation matters

• Certificate generation is required because clients must trust SafeSquid during interception.
• Bypass planning is required because some applications and destinations are not inspection-safe.
• Client deployment planning is required because one missed trust store can create a widespread certificate-warning incident.
• A pilot scope is required because HTTPS inspection can break business-critical traffic if enabled too broadly.

​

Step 1: Generate or Import Root CA Certificate

​

Generate Certificate in Self-Service Portal

1. Log in to the Self-Service Portal
2. Navigate to Certificate Management In the dashboard → find your deployment → click Manage Certificate

​

Option A: Self-Signed Certificate

3. Click Generate (appears if no certificate exists yet)
4. Select “General self-signed” → Enter passphrase → Generate :::caution Save Your Passphrase The passphrase is non-recoverable. Save it securely—you’ll need it to reuse the certificate with different activation keys. :::
5. Click Close to continue

​

Option B: Enterprise CA with Existing Passphrase

3. Click Regenerate → Upload enterprise CA files → Select “has passphrase”
4. Select CA certificate files (.crt and .key)
5. Enter passphrase → Click “Validate private key”
6. Select “Retain password” → Upload
7. Click Close

​

Option C: Enterprise CA Without Passphrase (Set New One)

3. Click Regenerate → Upload enterprise CA → Select “does not have passphrase”
4. Select CA certificate files
5. Enter new passphrase → Upload :::caution Save Your Passphrase This new passphrase is non-recoverable. Save it securely. :::
6. Click Close

​

Download Certificate

7. Enter passphrase (if prompted) → Click Download

​

Step 2: Enable HTTPS Inspection in SafeSquid

​

Access Configuration Portal

1. Open SafeSquid interface → Click “Configure”
2. Expand “Real Time Content Security” in the sidebar
3. Click “HTTPS Inspection”

​

Enable Global HTTPS Inspection

4. Click the “Global” tab → Click Edit (pencil icon) :::note Version Change SafeSquid versions after June 2017 have three tabs: Global, Inspection Policies, and Bypass Policies. :::
5. Set “Enabled” to “True” → Save Policy

​

Enable Inspection Policies

6. Click “Inspection Policies” tab
7. Verify default policies are enabled
8. Find “Enforce SSL scanning for all websites” → Click Edit
9. Set “Enabled” to “True” → Save Policy

​

Save Configuration

10. Click “Save Configuration” (floppy disk icon, bottom left)
11. Select “No” (unless deploying to a cluster) → Submit :::tip Cloud Config Select “Yes” only if:
    • You’re deploying the same config to multiple SafeSquid instances (cluster)
    • All sections are fully configured for production
    Otherwise, select “No” to save locally only. :::

​

Step 2 validation checkpoint

• global inspection is enabled
• the intended inspection policy is enabled
• cluster-save behavior matches the rollout plan

​

Step 3: Deploy Root CA to Clients

​

Windows (Chrome, Edge, IE)

1. Double-click the downloaded certificate
2. Install Certificate → Local Machine → Next
3. Browse → Trusted Root Certification Authorities → OK
4. Next → Finish

​

Firefox (All Platforms)

1. Download the SafeSquid Root CA (from Step 1)
2. Open Firefox → Settings → Privacy & Security → Certificates → View Certificates
3. Authorities tab → Import
4. Select the SafeSquid certificate file
5. Check “Trust this CA to identify websites” → OK

• Visit https://www.google.com (via SafeSquid proxy)
• Click padlock → More information → View Certificate
• Certificate chain should show SafeSquid Root CA

​

macOS

1. Double-click the certificate file
2. Add → Enter admin password
3. Open Keychain Access → System keychain
4. Find SafeSquid certificate → Get Info
5. Trust section → When using this certificate → Always Trust

​

Mobile Devices

• Deploy via MDM (Jamf, Intune, Workspace ONE)
• Manual: Email certificate → Open on device → Install

​

Step 4: Validate inspection and bypass behavior

1. Positive inspection test
   Visit a site that should be inspected and confirm the presented certificate is issued through the SafeSquid trust path.
2. Negative bypass test
   Visit a destination that should be bypassed and confirm the original site certificate remains intact.

​

Step 5: Configure Bypass Policies

• Banking and financial sites (compliance)
• Healthcare portals (HIPAA)
• SSL-pinned applications (will break otherwise)
• Government sites

​

Enable Default Bypass Policy

1. Click “Configure” in SafeSquid interface
2. Click Search (magnifying glass icon, top right)
3. Type “BYPASS SSL INSPECTION” → Enter
4. Click Edit on the bypass policy
5. Set “Enabled” to “True” → Save Policy
6. Review and enable related bypass policies (for banking apps, Windows Update, etc.)

​

Create Custom Bypass for Specific Domains

1. Sidebar → Profiling Engine → Request Types → Add New
2. Comment: “Dropbox domains”
   Match pattern: .*dropbox.*
   Smart TLD: True

3. Sidebar → Access Policies → Access Profiles → Add New
4. Comment: “Bypass SSL for Dropbox”
   Request Type: Select “Dropbox domains” (from Step 1)
   Added profiles: Select “BYPASS SSL INSPECTION”
5. Save Policy
6. Save Configuration (floppy disk icon, bottom left)

​

Verification

​

Test HTTPS Inspection is Working

1. Browse to https://www.google.com
2. Click padlock → Certificate → View
3. Verify: Certificate chain shows SafeSquid Root CA as the issuer
4. No certificate warnings should appear

www.google.com (issued by SafeSquid Root CA)
  └─ SafeSquid Root CA (self-signed or your enterprise CA)

​

Test Bypass is Working

1. Browse to a bypassed site (e.g., banking site you added to bypass)
2. Click padlock → Certificate → View
3. Verify: Certificate shows the original site’s CA (not SafeSquid)

​

Check SafeSquid Logs

tail -f /var/log/safesquid/access/extended.log

• Full URL logged (including path, not just domain)
• 200 OK or similar HTTP status

• Only CONNECT method logged
• No detailed path information

​

Troubleshooting

1. Verify HTTPS Inspection is enabled:
   • Configuration Portal → Real-time Content Security → HTTPS Inspection → Global = True
2. Check certificate is deployed:
   • Windows: Run certmgr.msc → Trusted Root Certification Authorities → Certificates
   • Firefox: Settings → Privacy & Security → Certificates → View Certificates → Authorities
   • macOS: Keychain Access → System → Find SafeSquid cert
3. Test with curl:
   # Should work without cert if bypass is correct:
   curl --proxy http://SAFESQUID-IP:8080 https://www.google.com
   
4. Check SafeSquid logs:
   tail -50 /var/log/safesquid/safesquid.log
   grep -i "ssl\|cert\|handshake" /var/log/safesquid/safesquid.log
   

​

Source register

​

Next Steps

1. Authentication — Enable user-aware policies (SSL Inspection must be working first)
2. Access Restriction — Configure URL filtering (now works on HTTPS)
3. Data Leakage Prevention — Scan HTTPS uploads for sensitive data
4. Troubleshooting — SSL-specific issues and diagnostics

• Self-Service Portal — Manage certificates
• Import Certificate into Chrome/IE — Detailed Windows guide