Internal certificate authority

A managed device uses the configured internal certificate authority to sign a replacement server certificate during the TLS handshake. It then decrypts and inspects the traffic.

This topic discusses how to add an internal certificate authority (CA) to an outbound section of a standard decryption policy. The internal CA must be trusted by users on your network to avoid seeing untrusted certificate errors in their web browser.