To bypass TLS decryption, add a Do Not Inspect HTTP policy for the application or domain. To allow HTTP filtering while accessing a site with an insecure certificate, set your Untrusted certificate action to Pass through. You can resolve the issue by adding the Cloudflare certificate to the application (if supported by the application) or by exempting the application from TLS decryption. If you try to perform TLS decryption, these applications may not load or may return an error. Conversely, Cloudflare does not trust applications that use self-signed certificates instead of certificates signed by a public CA. For example, the vast majority of mobile applications use embedded certificates.

ESNI and ECH handshake encryption Incompatible certificatesĪpplications that use embedded certificates and mTLS authentication do not trust the Cloudflare certificate.

Gateway does not support TLS decryption for applications which use:

(Optional) Select Enable only cipher suites and TLS versions compliant with FIPS 140-2.

In Zero Trust External link icon Open external link, go to Settings > Network.When you enable TLS decryption, Gateway will decrypt all traffic sent over HTTPS, apply your HTTP policies, and then re-encrypt the request with a user-side certificate. Cloudflare Gateway can perform SSL/TLS decryption External link icon Open external link in order to inspect HTTPS traffic for malware and other security risks.

Decrypt https traffic