Skip to content

Commit ad83c34

Browse files
maxvpmaxvp
authored
[Gateway] Clarify DNI + TLS decryption (#17266)
1 parent 1ffccf9 commit ad83c34

File tree

2 files changed

+35
-26
lines changed

2 files changed

+35
-26
lines changed

‎src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,7 @@ Information contained within HTTPS encryption, such as the full requested URL, w
283283

284284
Do Not Inspect lets you bypass certain elements from inspection. To prevent Gateway from decrypting and inspecting HTTPS traffic, your policy must match against the Server Name Indicator (SNI) in the TLS header. When accessing a Do Not Inspect site in the browser, your browser may display a **Your connection is not private** warning, which you can proceed through to connect. For more information about applications which may require a Do Not Inspect policy, refer to [TLS decryption limitations](/cloudflare-one/policies/gateway/http-policies/tls-decryption/#inspection-limitations).
285285

286-
All Do Not Inspect rules are evaluated first, before any Allow or Block rules, to determine if decryption should occur. For more information, refer to [Order of enforcement](/cloudflare-one/policies/gateway/order-of-enforcement/#http-policies).
286+
All Do Not Inspect rules are evaluated first, before any Allow or Block rules, to determine if inspection should occur. For more information, refer to [Order of enforcement](/cloudflare-one/policies/gateway/order-of-enforcement/#http-policies).
287287

288288
### Do Not Scan
289289

‎src/content/docs/cloudflare-one/policies/gateway/http-policies/tls-decryption.mdx‎

Lines changed: 34 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,21 @@ pcx_content_type: concept
33
title: TLS decryption
44
sidebar:
55
order: 3
6-
76
---
87

9-
import { GlossaryDefinition, GlossaryTooltip, Render, TabItem, Tabs } from "~/components"
8+
import {
9+
GlossaryDefinition,
10+
GlossaryTooltip,
11+
Render,
12+
TabItem,
13+
Tabs,
14+
} from "~/components";
15+
16+
Cloudflare Gateway can perform [SSL/TLS decryption](https://www.cloudflare.com/learning/security/what-is-https-inspection/) in order to inspect HTTPS traffic for malware and other security risks.
17+
18+
When you enable TLS decryption, Gateway will decrypt all traffic sent over HTTPS, apply your HTTP policies, and then re-encrypt the request with a [user-side certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/). Gateway will decrypt and re-encrypt traffic regardless of HTTP policy action, including [Do Not Inspect](/cloudflare-one/policies/gateway/http-policies/#do-not-inspect).
1019

11-
Cloudflare Gateway can perform [SSL/TLS decryption](https://www.cloudflare.com/learning/security/what-is-https-inspection/) in order to inspect HTTPS traffic for malware and other security risks. When you enable TLS decryption, Gateway will decrypt all traffic sent over HTTPS, apply your HTTP policies, and then re-encrypt the request with a [user-side certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/).
20+
Cloudflare prevents interference by decrypting, inspecting, and re-encrypting HTTPS requests in its data centers in memory only. Gateway only stores eligible cache content at rest. All cache disks are encrypted at rest. You can configure where TLS decryption takes place with [Regional Services](/data-localization/regional-services/) in the [Cloudflare Data Localization Suite (DLS)](/data-localization/).
1221

1322
## Enable TLS decryption
1423

@@ -18,23 +27,23 @@ Cloudflare Gateway can perform [SSL/TLS decryption](https://www.cloudflare.com/l
1827

1928
Gateway does not support TLS decryption for applications which use:
2029

21-
* [Certificate pinning](#incompatible-certificates)
22-
* [Self-signed certificates](#incompatible-certificates)
23-
* [Mutual TLS (mTLS) authentication](#incompatible-certificates)
24-
* [ESNI and ECH handshake encryption](#esni-and-ech)
25-
* [Automatic HTTPS upgrades](#google-chrome-automatic-https-upgrades)
30+
- [Certificate pinning](#incompatible-certificates)
31+
- [Self-signed certificates](#incompatible-certificates)
32+
- [Mutual TLS (mTLS) authentication](#incompatible-certificates)
33+
- [ESNI and ECH handshake encryption](#esni-and-ech)
34+
- [Automatic HTTPS upgrades](#google-chrome-automatic-https-upgrades)
2635

2736
### Incompatible certificates
2837

2938
Applications that use certificate pinning and mTLS authentication do not trust the Cloudflare certificate. For example, most mobile applications use <GlossaryTooltip term="certificate pinning" link="/ssl/reference/certificate-pinning/">certificate pinning</GlossaryTooltip>. Cloudflare does not trust applications that use self-signed certificates instead of certificates signed by a public CA.
3039

3140
If you try to perform TLS decryption, these applications may not load or may return an error. To resolve this issue, you can:
3241

33-
* Add the [Cloudflare certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert/#add-the-certificate-to-applications) to supported applications.
34-
* Create a [Do Not Inspect policy](/cloudflare-one/policies/gateway/http-policies/#do-not-inspect) to exempt applications from TLS decryption. The [Application selector](/cloudflare-one/policies/gateway/http-policies/#application) provides a list of trusted applications that are known to use embedded certificates.
35-
* Configure a [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) in Include mode to ensure Gateway will only inspect traffic destined for your IPs or domains. This is useful for organizations that deploy Zero Trust on users' personal devices or otherwise expect personal applications to be used.
42+
- Add the [Cloudflare certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/install-cloudflare-cert/#add-the-certificate-to-applications) to supported applications.
43+
- Create a [Do Not Inspect policy](/cloudflare-one/policies/gateway/http-policies/#do-not-inspect) to exempt applications from inspection. The [Application selector](/cloudflare-one/policies/gateway/http-policies/#application) provides a list of trusted applications that are known to use embedded certificates.
44+
- Configure a [Split Tunnel](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/split-tunnels/) in Include mode to ensure Gateway will only inspect traffic destined for your IPs or domains. This is useful for organizations that deploy Zero Trust on users' personal devices or otherwise expect personal applications to be used.
3645

37-
Alternatively, to allow HTTP filtering while accessing a site with an insecure certificate, set your [Untrusted certificate action](/cloudflare-one/policies/gateway/http-policies/#untrusted-certificates) to *Pass through*.
46+
Alternatively, to allow HTTP filtering while accessing a site with an insecure certificate, set your [Untrusted certificate action](/cloudflare-one/policies/gateway/http-policies/#untrusted-certificates) to _Pass through_.
3847

3948
### Google Chrome automatic HTTPS upgrades
4049

@@ -54,7 +63,7 @@ To disable automatic HTTPS upgrades for a URL across your Zero Trust organizatio
5463
| -------- | -------- | ------------- | ------ |
5564
| URL | in | `example.com` | Allow |
5665

57-
3. In **Untrusted certificate action**, choose *Pass through*.
66+
3. In **Untrusted certificate action**, choose _Pass through_.
5867

5968
4. Select **Create policy**.
6069

@@ -98,17 +107,17 @@ FIPS-compliant traffic defaults to HTTP/3. Gateway does not inspect HTTP/3 traff
98107

99108
The following table lists the default cipher suites Gateway uses for TLS decryption.
100109

101-
| Name (OpenSSL) | Name (IANA) | FIPS-compliant |
102-
| ----------------------------- | ---------------------------------------------- | -------------- |
103-
| ECDHE-ECDSA-AES128-GCM-SHA256 | TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256 | ✅ |
104-
| ECDHE-ECDSA-AES256-GCM-SHA384 | TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384 | ✅ |
105-
| ECDHE-RSA-AES128-GCM-SHA256 | TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 | ✅ |
106-
| ECDHE-RSA-AES256-GCM-SHA384 | TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 | ✅ |
107-
| ECDHE-RSA-AES128-SHA | TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256 | ❌ |
108-
| ECDHE-RSA-AES256-SHA384 | TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384 | ✅ |
109-
| AES128-GCM-SHA256 | TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 | ✅ |
110-
| AES256-GCM-SHA384 | TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384 | ✅ |
111-
| AES128-SHA | TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA | ❌ |
112-
| AES256-SHA | TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA | ❌ |
110+
| Name (OpenSSL) | Name (IANA) | FIPS-compliant |
111+
| ----------------------------- | --------------------------------------- | -------------- |
112+
| ECDHE-ECDSA-AES128-GCM-SHA256 | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | ✅ |
113+
| ECDHE-ECDSA-AES256-GCM-SHA384 | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | ✅ |
114+
| ECDHE-RSA-AES128-GCM-SHA256 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | ✅ |
115+
| ECDHE-RSA-AES256-GCM-SHA384 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ✅ |
116+
| ECDHE-RSA-AES128-SHA | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | ❌ |
117+
| ECDHE-RSA-AES256-SHA384 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | ✅ |
118+
| AES128-GCM-SHA256 | TLS_RSA_WITH_AES_128_GCM_SHA256 | ✅ |
119+
| AES256-GCM-SHA384 | TLS_RSA_WITH_AES_256_GCM_SHA384 | ✅ |
120+
| AES128-SHA | TLS_RSA_WITH_AES_128_CBC_SHA | ❌ |
121+
| AES256-SHA | TLS_RSA_WITH_AES_256_CBC_SHA | ❌ |
113122

114123
For more information on cipher suites, refer to [Cipher suites](/ssl/edge-certificates/additional-options/cipher-suites/).

0 commit comments

Comments
 (0)