• Overview
• Domains excluded from TLS decryption
• If an application fails with TLS decryption on

Overview

When TLS decryption is on in an ITP policy (the Enable Advanced Configurations toggle; see Manage ITP Policies), Cloud Secure Edge (CSE) decrypts HTTPS traffic at the Secure Web Gateway (SWG) so that it can enforce URL entries, Risk-based URL Filtering, and Malware Download Protection.

Some applications stop working when their traffic is decrypted. The most common causes are:

• Certificate pinning. The application checks the server’s certificate against a list built into the application, and rejects the certificate that CSE issues during inspection.
• Mutual TLS. The application authenticates the client with its own certificate, which cannot be presented through decryption.
• Legal and compliance requirements. Some traffic, such as online banking and government tax services, is excluded from decryption for legal and compliance reasons.

SonicWall maintains a global list of exclusions for these cases. The list applies to every org automatically; you do not need to add these entries to your ITP policies.

Domains excluded from TLS decryption

The list below is loaded each time you open this page, so it reflects the current exclusions. Traffic to these domains is never decrypted.

SonicWall domains, the domains CSE uses to operate its own service, and private IP address ranges (RFC 1918) are also never decrypted, and are not listed here.

If an application fails with TLS decryption on

1. Check whether the application’s domain is already in the list above.

2. If the application lets you add trusted certificates, add the CSE SWG certificate authority (CA) chain to it. Some applications, such as the ChatGPT desktop app, require this to be delivered through your mobile device management (MDM) system. See SWG CA Certificates for Certificate-Pinned Apps.

3. Otherwise, add the application’s domains to Domain and URL Bypass in the ITP policy (see Step 3: Bypass). Add them as domain entries: a URL entry cannot fix this problem, because CSE must decrypt the traffic to match a URL.

Note: Domain and URL Bypass excludes the domain from every ITP rule, not only from TLS decryption, and bypassed traffic does not appear in logging. Keep bypass entries as narrow as possible. See How ITP rules are processed.

If you find an application that fails to connect once TLS decryption is on, contact SonicWall Support so its domains can be considered for the global exclusion list.