[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EW4MP27MBBGB10ZH9ZYWSS":3,"skill-same:01M6EW4MP27MBBGB10ZH9ZYWSS":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6EW4MP27MBBGB10ZH9ZYWSS","performing-ssl-tls-inspection-configuration",null,"Configure SSL\u002FTLS inspection on network security devices to decrypt, inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates, exemptions, and privacy compliance.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ssl-tls-inspection-configuration\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"ssl","configuration","tls","performing ssl tls inspection configuration","tls-decryption","de","man","cm","configure","certificate","forward-proxy","https-inspection","network security","ssl-inspection","certificates","certificate-management","man-in-the-middle","network","encrypt","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-ssl-tls-inspection-configuration\ndescription: Configure SSL\u002FTLS inspection on network security devices to decrypt,\n  inspect, and re-encrypt HTTPS traffic for threat detection while managing certificates,\n  exemptions, and privacy compliance.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- ssl-inspection\n- tls-decryption\n- https-inspection\n- certificate-management\n- proxy\n- man-in-the-middle\n- network-security\n- forward-proxy\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1573\n---\n\n# Performing SSL\u002FTLS Inspection Configuration\n\n## Overview\n\nSSL\u002FTLS inspection (also called SSL decryption, HTTPS inspection, or TLS break-and-inspect) intercepts encrypted traffic between clients and servers to inspect the cleartext content for malware, data exfiltration, policy violations, and command-and-control communications. The inspection device acts as a trusted man-in-the-middle, terminating the TLS session from the client, inspecting the plaintext content, and establishing a new TLS session to the destination server. With over 95% of web traffic now encrypted, organizations without TLS inspection have a massive blind spot. This skill covers configuring TLS inspection on next-generation firewalls, deploying trusted CA certificates, managing exemptions for certificate-pinned applications, and ensuring compliance with privacy regulations.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing ssl tls inspection configuration\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Next-generation firewall or secure web gateway with TLS inspection capability\n- Internal Certificate Authority (CA) for signing inspection certificates\n- Endpoint certificate management (GPO, MDM, or manual deployment)\n- Privacy and legal review for TLS inspection scope\n- Understanding of PKI, X.509 certificates, and TLS handshake\n\n## Core Concepts\n\n### SSL\u002FTLS Inspection Modes\n\n| Mode | Direction | Description |\n|------|-----------|-------------|\n| **SSL Forward Proxy** | Outbound | Intercepts client-to-internet HTTPS connections |\n| **SSL Inbound Inspection** | Inbound | Decrypts traffic destined for internal servers |\n| **SSH Proxy** | Both | Inspects SSH tunneled traffic |\n\n### Forward Proxy Process\n\n```\nClient                  Firewall\u002FProxy              Web Server\n  │                         │                          │\n  │──TLS ClientHello──────→│                          │\n  │                         │──TLS ClientHello───────→│\n  │                         │←─TLS ServerHello────────│\n  │                         │  (real server cert)      │\n  │                         │                          │\n  │                         │  [Validates server cert]  │\n  │                         │  [Generates proxy cert   │\n  │                         │   signed by internal CA]  │\n  │                         │                          │\n  │←─TLS ServerHello───────│                          │\n  │  (proxy-signed cert)    │                          │\n  │                         │                          │\n  │──Encrypted data────────→│  [Decrypt, Inspect]      │\n  │                         │──Encrypted data────────→│\n  │←─Encrypted data─────────│  [Decrypt, Inspect]      │\n  │                         │←─Encrypted data─────────│\n```\n\n### Certificate Trust Chain\n\n```\nEnterprise Root CA\n  └── Subordinate CA (SSL Inspection)\n        └── Dynamically Generated Server Certificates\n             (CN matches requested server)\n```\n\n## Workflow\n\n### Step 1: Generate Internal CA for SSL Inspection\n\n```bash\n# Create private key for SSL Inspection CA\nopenssl genrsa -aes256 -out ssl-inspect-ca.key 4096\n\n# Create CA certificate (5 year validity)\nopenssl req -new -x509 -key ssl-inspect-ca.key \\\n  -sha256 -days 1825 \\\n  -out ssl-inspect-ca.crt \\\n  -subj \"\u002FC=US\u002FST=California\u002FO=Corp Inc\u002FOU=Network Security\u002FCN=Corp SSL Inspection CA\" \\\n  -extensions v3_ca \\\n  -config \u003C(cat \u003C\u003CEOF\n[req]\ndistinguished_name = req_dn\nx509_extensions = v3_ca\n\n[req_dn]\n\n[v3_ca]\nbasicConstraints = critical,CA:TRUE,pathlen:0\nkeyUsage = critical,digitalSignature,keyCertSign,cRLSign\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always\nEOF\n)\n\n# Verify certificate\nopenssl x509 -in ssl-inspect-ca.crt -text -noout\n```\n\n### Step 2: Deploy CA Certificate to Endpoints\n\n**Windows (Group Policy):**\n\n```powershell\n# Import CA cert to trusted root store via GPO\n# Computer Configuration > Policies > Windows Settings >\n# Security Settings > Public Key Policies > Trusted Root CAs\n\n# Or deploy via PowerShell\nImport-Certificate -FilePath \"\\\\server\\share\\ssl-inspect-ca.crt\" `\n  -CertStoreLocation \"Cert:\\LocalMachine\\Root\"\n\n# Verify deployment\nGet-ChildItem Cert:\\LocalMachine\\Root | Where-Object {\n    $_.Subject -like \"*SSL Inspection CA*\"\n}\n```\n\n**macOS (MDM profile or manual):**\n\n```bash\n# Install via command line\nsudo security add-trusted-cert -d -r trustRoot \\\n  -k \u002FLibrary\u002FKeychains\u002FSystem.keychain ssl-inspect-ca.crt\n```\n\n**Linux:**\n\n```bash\n# Ubuntu\u002FDebian\nsudo cp ssl-inspect-ca.crt \u002Fusr\u002Flocal\u002Fshare\u002Fca-certificates\u002F\nsudo update-ca-certificates\n\n# RHEL\u002FCentOS\nsudo cp ssl-inspect-ca.crt \u002Fetc\u002Fpki\u002Fca-trust\u002Fsource\u002Fanchors\u002F\nsudo update-ca-trust\n```\n\n### Step 3: Configure Palo Alto SSL Forward Proxy\n\n```\n# Import CA certificate to firewall\n# Device > Certificate Management > Certificates > Import\n\n# Set as Forward Trust CA\nset shared certificate SSL-Inspect-CA forward-trust-certificate yes\n\n# Create Decryption Profile\nset profiles decryption Corporate-Decrypt ssl-forward-proxy block-expired-certificate yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy block-untrusted-issuer yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy block-unknown-cert yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy restrict-cert-exts yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy strip-alpn no\n\n# Minimum TLS version\nset profiles decryption Corporate-Decrypt ssl-protocol-settings min-version tls1-2\nset profiles decryption Corporate-Decrypt ssl-protocol-settings max-version max\n\n# Decryption policy - decrypt outbound HTTPS\nset rulebase decryption rules Decrypt-Outbound from Trust to Untrust\nset rulebase decryption rules Decrypt-Outbound source any\nset rulebase decryption rules Decrypt-Outbound destination any\nset rulebase decryption rules Decrypt-Outbound service any\nset rulebase decryption rules Decrypt-Outbound action decrypt\nset rulebase decryption rules Decrypt-Outbound type ssl-forward-proxy\nset rulebase decryption rules Decrypt-Outbound profile Corporate-Decrypt\n```\n\n### Step 4: Configure Exemptions\n\nCertain applications and categories must be excluded from TLS inspection:\n\n```\n# Exempt certificate-pinned applications\nset rulebase decryption rules No-Decrypt-Pinned from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Pinned application [ apple-update microsoft-update dropbox-base ]\nset rulebase decryption rules No-Decrypt-Pinned action no-decrypt\n\n# Exempt privacy-sensitive categories\nset rulebase decryption rules No-Decrypt-Privacy from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Privacy category [ health-and-medicine financial-services ]\nset rulebase decryption rules No-Decrypt-Privacy action no-decrypt\n\n# Exempt specific high-trust domains\nset rulebase decryption rules No-Decrypt-Trusted from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Trusted destination [ bank-of-america.com chase.com healthcare.gov ]\nset rulebase decryption rules No-Decrypt-Trusted action no-decrypt\n```\n\n### Step 5: Configure Inbound Inspection for Internal Servers\n\n```\n# Import server certificate and private key\n# Device > Certificate Management > Certificates > Import\n\n# Inbound inspection policy\nset rulebase decryption rules Inspect-WebServers from Untrust to DMZ\nset rulebase decryption rules Inspect-WebServers destination [ 10.0.20.10 10.0.20.11 ]\nset rulebase decryption rules Inspect-WebServers service service-https\nset rulebase decryption rules Inspect-WebServers action decrypt\nset rulebase decryption rules Inspect-WebServers type ssl-inbound-inspection\nset rulebase decryption rules Inspect-WebServers profile Corporate-Decrypt\n```\n\n### Step 6: Validate SSL Inspection\n\n```bash\n# Test from client - verify certificate issuer is internal CA\nopenssl s_client -connect www.google.com:443 -servername www.google.com 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -issuer -subject\n\n# Expected output (with inspection active):\n# issuer= \u002FC=US\u002FO=Corp Inc\u002FOU=Network Security\u002FCN=Corp SSL Inspection CA\n# subject= \u002FCN=www.google.com\n\n# Verify no certificate errors in browser\n# Check firewall decryption logs for errors\n\n# Test with curl\ncurl -v https:\u002F\u002Fwww.example.com 2>&1 | grep \"issuer\"\n\n# Check decryption statistics on firewall\nshow system setting ssl-decrypt memory\nshow system setting ssl-decrypt certificate-cache\nshow counter global filter category ssl\n```\n\n## Performance Considerations\n\n| Factor | Impact | Mitigation |\n|--------|--------|-----------|\n| CPU overhead | 50-80% increase per session | Hardware SSL acceleration, dedicated decrypt appliance |\n| Throughput reduction | 40-60% typical | Size decryption hardware for peak encrypted traffic |\n| Latency increase | 1-5ms additional | Place inspection close to users |\n| TLS 1.3 0-RTT | Cannot inspect 0-RTT data | Block 0-RTT or accept risk |\n| Certificate pinning | Inspection fails | Add to exemption list |\n| QUIC\u002FHTTP3 | Bypasses traditional proxy | Block QUIC, force HTTP\u002F2 |\n\n## Compliance and Privacy\n\n- **Employee Notice** - Notify users that network traffic is subject to inspection\n- **Privacy Exemptions** - Exclude healthcare, financial, and legally privileged traffic\n- **Data Handling** - Inspected cleartext must not be logged or stored unnecessarily\n- **GDPR Compliance** - Document lawful basis for processing encrypted personal data\n- **Certificate Pinning** - Maintain exemption list for applications using HPKP or built-in pins\n\n## Best Practices\n\n- **Start with Logging** - Deploy in detect-only mode first to identify certificate-pinned applications\n- **Maintain Exemption List** - Keep a curated list of applications requiring decryption bypass\n- **Block QUIC** - Block UDP\u002F443 to force HTTP\u002F2 through TLS inspection\n- **Monitor Certificate Errors** - Track decryption errors in firewall logs\n- **TLS 1.2 Minimum** - Enforce TLS 1.2 as minimum version; block SSLv3 and TLS 1.0\u002F1.1\n- **Key Protection** - Store inspection CA private key in HSM for production environments\n- **Regular CA Rotation** - Plan for CA certificate rotation before expiration\n\n## References\n\n- [Palo Alto SSL Decryption](https:\u002F\u002Fdocs.paloaltonetworks.com\u002Fnetwork-security\u002Fdecryption)\n- [Cisco SSL\u002FTLS Proxy](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Ftd\u002Fdocs\u002Frouters\u002Fsdwan\u002Fconfiguration\u002Fsecurity\u002Fios-xe-17\u002Fsecurity-book-xe\u002Fm-ssl-proxy.html)\n- [NIST SP 800-52 Rev 2 - TLS Configuration](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-52\u002Frev-2\u002Ffinal)\n- [US-CERT Alert on HTTPS Inspection](https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2017\u002F03\u002F13\u002Fhttps-interception-weakens-tls-security)\n","# Performing SSL\u002FTLS Inspection Configuration\n\n## Overview\n\nSSL\u002FTLS inspection (also called SSL decryption, HTTPS inspection, or TLS break-and-inspect) intercepts encrypted traffic between clients and servers to inspect the cleartext content for malware, data exfiltration, policy violations, and command-and-control communications. The inspection device acts as a trusted man-in-the-middle, terminating the TLS session from the client, inspecting the plaintext content, and establishing a new TLS session to the destination server. With over 95% of web traffic now encrypted, organizations without TLS inspection have a massive blind spot. This skill covers configuring TLS inspection on next-generation firewalls, deploying trusted CA certificates, managing exemptions for certificate-pinned applications, and ensuring compliance with privacy regulations.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing ssl tls inspection configuration\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Next-generation firewall or secure web gateway with TLS inspection capability\n- Internal Certificate Authority (CA) for signing inspection certificates\n- Endpoint certificate management (GPO, MDM, or manual deployment)\n- Privacy and legal review for TLS inspection scope\n- Understanding of PKI, X.509 certificates, and TLS handshake\n\n## Core Concepts\n\n### SSL\u002FTLS Inspection Modes\n\n| Mode | Direction | Description |\n|------|-----------|-------------|\n| **SSL Forward Proxy** | Outbound | Intercepts client-to-internet HTTPS connections |\n| **SSL Inbound Inspection** | Inbound | Decrypts traffic destined for internal servers |\n| **SSH Proxy** | Both | Inspects SSH tunneled traffic |\n\n### Forward Proxy Process\n\n```\nClient                  Firewall\u002FProxy              Web Server\n  │                         │                          │\n  │──TLS ClientHello──────→│                          │\n  │                         │──TLS ClientHello───────→│\n  │                         │←─TLS ServerHello────────│\n  │                         │  (real server cert)      │\n  │                         │                          │\n  │                         │  [Validates server cert]  │\n  │                         │  [Generates proxy cert   │\n  │                         │   signed by internal CA]  │\n  │                         │                          │\n  │←─TLS ServerHello───────│                          │\n  │  (proxy-signed cert)    │                          │\n  │                         │                          │\n  │──Encrypted data────────→│  [Decrypt, Inspect]      │\n  │                         │──Encrypted data────────→│\n  │←─Encrypted data─────────│  [Decrypt, Inspect]      │\n  │                         │←─Encrypted data─────────│\n```\n\n### Certificate Trust Chain\n\n```\nEnterprise Root CA\n  └── Subordinate CA (SSL Inspection)\n        └── Dynamically Generated Server Certificates\n             (CN matches requested server)\n```\n\n## Workflow\n\n### Step 1: Generate Internal CA for SSL Inspection\n\n```bash\n# Create private key for SSL Inspection CA\nopenssl genrsa -aes256 -out ssl-inspect-ca.key 4096\n\n# Create CA certificate (5 year validity)\nopenssl req -new -x509 -key ssl-inspect-ca.key \\\n  -sha256 -days 1825 \\\n  -out ssl-inspect-ca.crt \\\n  -subj \"\u002FC=US\u002FST=California\u002FO=Corp Inc\u002FOU=Network Security\u002FCN=Corp SSL Inspection CA\" \\\n  -extensions v3_ca \\\n  -config \u003C(cat \u003C\u003CEOF\n[req]\ndistinguished_name = req_dn\nx509_extensions = v3_ca\n\n[req_dn]\n\n[v3_ca]\nbasicConstraints = critical,CA:TRUE,pathlen:0\nkeyUsage = critical,digitalSignature,keyCertSign,cRLSign\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always\nEOF\n)\n\n# Verify certificate\nopenssl x509 -in ssl-inspect-ca.crt -text -noout\n```\n\n### Step 2: Deploy CA Certificate to Endpoints\n\n**Windows (Group Policy):**\n\n```powershell\n# Import CA cert to trusted root store via GPO\n# Computer Configuration > Policies > Windows Settings >\n# Security Settings > Public Key Policies > Trusted Root CAs\n\n# Or deploy via PowerShell\nImport-Certificate -FilePath \"\\\\server\\share\\ssl-inspect-ca.crt\" `\n  -CertStoreLocation \"Cert:\\LocalMachine\\Root\"\n\n# Verify deployment\nGet-ChildItem Cert:\\LocalMachine\\Root | Where-Object {\n    $_.Subject -like \"*SSL Inspection CA*\"\n}\n```\n\n**macOS (MDM profile or manual):**\n\n```bash\n# Install via command line\nsudo security add-trusted-cert -d -r trustRoot \\\n  -k \u002FLibrary\u002FKeychains\u002FSystem.keychain ssl-inspect-ca.crt\n```\n\n**Linux:**\n\n```bash\n# Ubuntu\u002FDebian\nsudo cp ssl-inspect-ca.crt \u002Fusr\u002Flocal\u002Fshare\u002Fca-certificates\u002F\nsudo update-ca-certificates\n\n# RHEL\u002FCentOS\nsudo cp ssl-inspect-ca.crt \u002Fetc\u002Fpki\u002Fca-trust\u002Fsource\u002Fanchors\u002F\nsudo update-ca-trust\n```\n\n### Step 3: Configure Palo Alto SSL Forward Proxy\n\n```\n# Import CA certificate to firewall\n# Device > Certificate Management > Certificates > Import\n\n# Set as Forward Trust CA\nset shared certificate SSL-Inspect-CA forward-trust-certificate yes\n\n# Create Decryption Profile\nset profiles decryption Corporate-Decrypt ssl-forward-proxy block-expired-certificate yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy block-untrusted-issuer yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy block-unknown-cert yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy restrict-cert-exts yes\nset profiles decryption Corporate-Decrypt ssl-forward-proxy strip-alpn no\n\n# Minimum TLS version\nset profiles decryption Corporate-Decrypt ssl-protocol-settings min-version tls1-2\nset profiles decryption Corporate-Decrypt ssl-protocol-settings max-version max\n\n# Decryption policy - decrypt outbound HTTPS\nset rulebase decryption rules Decrypt-Outbound from Trust to Untrust\nset rulebase decryption rules Decrypt-Outbound source any\nset rulebase decryption rules Decrypt-Outbound destination any\nset rulebase decryption rules Decrypt-Outbound service any\nset rulebase decryption rules Decrypt-Outbound action decrypt\nset rulebase decryption rules Decrypt-Outbound type ssl-forward-proxy\nset rulebase decryption rules Decrypt-Outbound profile Corporate-Decrypt\n```\n\n### Step 4: Configure Exemptions\n\nCertain applications and categories must be excluded from TLS inspection:\n\n```\n# Exempt certificate-pinned applications\nset rulebase decryption rules No-Decrypt-Pinned from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Pinned application [ apple-update microsoft-update dropbox-base ]\nset rulebase decryption rules No-Decrypt-Pinned action no-decrypt\n\n# Exempt privacy-sensitive categories\nset rulebase decryption rules No-Decrypt-Privacy from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Privacy category [ health-and-medicine financial-services ]\nset rulebase decryption rules No-Decrypt-Privacy action no-decrypt\n\n# Exempt specific high-trust domains\nset rulebase decryption rules No-Decrypt-Trusted from Trust to Untrust\nset rulebase decryption rules No-Decrypt-Trusted destination [ bank-of-america.com chase.com healthcare.gov ]\nset rulebase decryption rules No-Decrypt-Trusted action no-decrypt\n```\n\n### Step 5: Configure Inbound Inspection for Internal Servers\n\n```\n# Import server certificate and private key\n# Device > Certificate Management > Certificates > Import\n\n# Inbound inspection policy\nset rulebase decryption rules Inspect-WebServers from Untrust to DMZ\nset rulebase decryption rules Inspect-WebServers destination [ 10.0.20.10 10.0.20.11 ]\nset rulebase decryption rules Inspect-WebServers service service-https\nset rulebase decryption rules Inspect-WebServers action decrypt\nset rulebase decryption rules Inspect-WebServers type ssl-inbound-inspection\nset rulebase decryption rules Inspect-WebServers profile Corporate-Decrypt\n```\n\n### Step 6: Validate SSL Inspection\n\n```bash\n# Test from client - verify certificate issuer is internal CA\nopenssl s_client -connect www.google.com:443 -servername www.google.com 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -issuer -subject\n\n# Expected output (with inspection active):\n# issuer= \u002FC=US\u002FO=Corp Inc\u002FOU=Network Security\u002FCN=Corp SSL Inspection CA\n# subject= \u002FCN=www.google.com\n\n# Verify no certificate errors in browser\n# Check firewall decryption logs for errors\n\n# Test with curl\ncurl -v https:\u002F\u002Fwww.example.com 2>&1 | grep \"issuer\"\n\n# Check decryption statistics on firewall\nshow system setting ssl-decrypt memory\nshow system setting ssl-decrypt certificate-cache\nshow counter global filter category ssl\n```\n\n## Performance Considerations\n\n| Factor | Impact | Mitigation |\n|--------|--------|-----------|\n| CPU overhead | 50-80% increase per session | Hardware SSL acceleration, dedicated decrypt appliance |\n| Throughput reduction | 40-60% typical | Size decryption hardware for peak encrypted traffic |\n| Latency increase | 1-5ms additional | Place inspection close to users |\n| TLS 1.3 0-RTT | Cannot inspect 0-RTT data | Block 0-RTT or accept risk |\n| Certificate pinning | Inspection fails | Add to exemption list |\n| QUIC\u002FHTTP3 | Bypasses traditional proxy | Block QUIC, force HTTP\u002F2 |\n\n## Compliance and Privacy\n\n- **Employee Notice** - Notify users that network traffic is subject to inspection\n- **Privacy Exemptions** - Exclude healthcare, financial, and legally privileged traffic\n- **Data Handling** - Inspected cleartext must not be logged or stored unnecessarily\n- **GDPR Compliance** - Document lawful basis for processing encrypted personal data\n- **Certificate Pinning** - Maintain exemption list for applications using HPKP or built-in pins\n\n## Best Practices\n\n- **Start with Logging** - Deploy in detect-only mode first to identify certificate-pinned applications\n- **Maintain Exemption List** - Keep a curated list of applications requiring decryption bypass\n- **Block QUIC** - Block UDP\u002F443 to force HTTP\u002F2 through TLS inspection\n- **Monitor Certificate Errors** - Track decryption errors in firewall logs\n- **TLS 1.2 Minimum** - Enforce TLS 1.2 as minimum version; block SSLv3 and TLS 1.0\u002F1.1\n- **Key Protection** - Store inspection CA private key in HSM for production environments\n- **Regular CA Rotation** - Plan for CA certificate rotation before expiration\n\n## References\n\n- [Palo Alto SSL Decryption](https:\u002F\u002Fdocs.paloaltonetworks.com\u002Fnetwork-security\u002Fdecryption)\n- [Cisco SSL\u002FTLS Proxy](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Ftd\u002Fdocs\u002Frouters\u002Fsdwan\u002Fconfiguration\u002Fsecurity\u002Fios-xe-17\u002Fsecurity-book-xe\u002Fm-ssl-proxy.html)\n- [NIST SP 800-52 Rev 2 - TLS Configuration](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-52\u002Frev-2\u002Ffinal)\n- [US-CERT Alert on HTTPS Inspection](https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2017\u002F03\u002F13\u002Fhttps-interception-weakens-tls-security)\n",{"name":5,"tags":54,"author":57,"domain":48,"license":15,"version":58,"nist_csf":59,"subdomain":56,"description":7,"mitre_attack":64},[42,33,40,44,55,45,56,39],"proxy","network-security","mahipal","1.0",[60,61,62,63],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[65,66,67,68,69],"T1046","T1040","T1557","T1071","T1573","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-ssl-tls-inspection-configuration","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-ssl-tls-inspection-configuration",{"tool":84,"command":85},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-ssl-tls-inspection-configuration",{"tool":87,"command":88},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-ssl-tls-inspection-configuration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ssl-tls-inspection-configuration\u002FSKILL.md",true,[92,97,103],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ssl-tls-inspection-configuration\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",2263,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ssl-tls-inspection-configuration\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",6420,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ssl-tls-inspection-configuration\u002Fscripts\u002Fagent.py",[110,149,158,167,189,215],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":129,"publishedAt":49},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[117,120,123,126],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":127,"categoryName":128,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000034","行政与办公人员",[112,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":150,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":157,"publishedAt":49},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[153,154,155,156],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":26,"taxonomyTypeDesc":27},[112,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":159,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":49},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[162,163,164,165],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":26,"taxonomyTypeDesc":27},[112,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":49},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":49},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,200,201,202,203,204,205,206,207,141,142,208,209,210,211,212,213,214],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":114,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":231,"publishedAt":49},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[221,224,227,228],{"categoryNo":222,"categoryName":223,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":225,"categoryName":226,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":229,"categoryName":230,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[232,233,234,235,236,237,238,239,138,240,141,142,143,241,242,243,244,245,188,246],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]