SSL inspection and URL categories: what to decrypt and what to leave alone
SSL inspection lets a firewall or web gateway see inside HTTPS traffic. URL categories decide where that is worth doing and where it is not. Getting the split right protects users, respects privacy and keeps the network fast.
Without decryption the filter sees
hostname: files.example-share.net
destination address and port 443
path: /d/8f3k2/invoice.zip
file type and content
With decryption the filter sees
hostname: files.example-share.net
full path: /d/8f3k2/invoice.zip
file type: compressed archive
content for malware and data rules
What SSL inspection actually does
The name is old: modern traffic uses TLS, not SSL, but "SSL inspection" and "SSL decryption" are still the everyday terms. The inspecting device sits in the middle of the HTTPS session. It completes the encrypted connection to the website on the user's behalf, then opens a second encrypted connection to the user.
Between the two, the traffic is readable. The device checks the full URL, scans files and applies data rules, then passes the content on. Managed devices accept this because they trust a company root certificate that signs the replacement certificates.
Why teams turn it on
Most malware and phishing now arrive over HTTPS. Without inspection, downloads cannot be scanned and path-level rules cannot work.
Why teams hold back
Decryption touches private data, breaks some apps and costs processing power. Inspecting everything is rarely the right answer.
Other ways to see the full URL
Network decryption is not the only route to path-level visibility. Each option below sees the URL at a different point, with its own trade-offs.
| Approach | How it sees the URL | Best for | Limits |
|---|---|---|---|
| Network inspection | Decrypts traffic at the firewall or gateway | Covering all managed devices on site or through a cloud gateway | Certificate rollout, pinned apps, processing cost |
| Browser extension | Reads the URL inside the browser before it is encrypted | Managed browsers, school devices | Only covers that browser, not other apps |
| Endpoint agent | Hooks into the operating system's network stack | Laptops that roam between networks | Needs deployment on every device |
| Remote browser isolation | Loads the page in a remote browser and streams the result | Uncategorized and high-risk sites | Cost and some loss of user experience |
For the bigger picture of the products that do this, see what is a secure web gateway, and for URL rules in general, what is URL filtering.
What a filter can see at each stage
Even without decryption, a filter has several places to read the destination. Which ones are available depends on the protocol version and on newer privacy features.
| Signal | Where it comes from | Visible without decryption? | Notes |
|---|---|---|---|
| Domain in DNS lookup | The device's name query | Yes, if DNS goes to your resolver | Hidden when devices use their own encrypted DNS |
| Server Name Indication | TLS handshake, first message | Usually | Hidden when Encrypted Client Hello is used |
| Server certificate | TLS handshake | TLS 1.2 yes, TLS 1.3 no | TLS 1.3 encrypts the certificate exchange |
| Destination IP address | Packet headers | Yes | Many sites share addresses on CDNs, so it is a weak signal |
| Full URL path and query | HTTP request inside TLS | No | Needs decryption or a browser or endpoint agent |
| Page content and files | HTTP body inside TLS | No | Needs decryption |
The key point: domain-level category filtering works on almost all HTTPS traffic without decryption, because the hostname is available from DNS or the handshake. Decryption is what you add for paths, files and data rules.
Using URL categories to decide what to decrypt
Almost every inspection product lets you set decryption rules by URL category. The category is read from the hostname before decryption starts, so it can steer the decision. This is the most common way to build a sensible policy.
Usually inspect
- Uncategorized hostnamesno history, higher risk
- Newly registered domainscommon for phishing in the first days
- File Sharing/P2Pmalware and data leaving the company
- Cloud Storage / File Hostingupload controls need content
- URL Shortenersfinal destination is hidden
- Parked / For-Sale Domainsoften redirect to scams
- AI / LLM Toolsprompt and file data rules
Usually exempt
- Online Bankingpersonal finance privacy
- Financial Servicesoften grouped with banking
- Health & Medicinesensitive personal data
- Government & Legalsome services expect direct connections
- Pinned apps and update servicesbreak when certificates change
- Video calls and real-time appslatency and pinning issues
Depends on policy
- Email and Messagingdata rules versus privacy
- Social Networkingneeded for posting controls
- Web-based Applicationsbusiness apps, decide per app
- Search Engines & Platformssafe search may need it
- Streaming Mediahigh volume, low risk, often skipped
- Developer Tools / Code Hostingcode leaving the company
Exempting by category scales far better than exempting by hand-made domain lists. When a new regional bank or clinic portal appears, it inherits the exemption as soon as it carries the right label, with no admin work.
Treat these lists as a starting point and check them with your legal and privacy teams. Rules about inspecting employee traffic differ by country and sector and change over time.
A decision flow for each new HTTPS session
Many gateways evaluate decryption with a short sequence of questions. Writing your own version down makes the policy easier to explain and audit, and it gives new team members a clear reference.
Is the destination on the bypass list?
Pinned apps, update services and named partners skip inspection. The domain category is still logged.
Yes: pass without decryptionIs the category blocked outright?
Malware, Adult or Gambling can be blocked from the hostname alone. No need to decrypt before blocking.
Yes: block, show page if certificate allowsIs the category on the exempt list?
Banking and health sites pass encrypted, in line with the privacy policy.
Yes: allow without decryptionIs the device managed and trusting the root?
Unmanaged devices will show certificate errors if decrypted, so they get domain-level rules only.
No: category rules on hostname onlyInspect and apply content rules
Decrypt, check the full URL against path rules, scan files, apply upload and data rules, then log.
Result: allow, warn, isolate or blockOrder matters: placing the outright block check before decryption saves work, because blocked sessions never need to be opened. Placing the exemption check before the device check means privacy rules apply to every device, managed or not.
Keep the flow the same across offices and cloud gateways. When two engines use different orders, the same site can be decrypted in one place and exempt in another, which confuses users and auditors alike.
Why the hostname category has to be right first
Every step above depends on the category of the hostname, read before any content is visible. If the category is wrong, the wrong decision follows: a banking site gets decrypted, or a malware download slips through an exemption.
Exemptions must be precise
A health portal mislabelled as Business loses its exemption. Ranked categories help, because the primary label drives the decision.
Unknown must stay rare
Every uncategorized hostname goes down the costly inspection path. Broad coverage keeps that path small.
Fresh domains need labels fast
About 300,000 newly registered domains are categorized each day in our database, then rechecked after a week and a month.
Subdomains matter
Shared platforms host very different content on subdomains. Hostname-level labels, with fallback to the registered domain, give better decisions.
You can see how a hostname is categorized with the URL checker. The full category list and definitions are on the web filtering categories page.
New protocols that change the picture
Three developments affect what a filter can read without decryption. Each pushes some of the work to other layers.
| Change | What it does | Effect on filtering | Response |
|---|---|---|---|
| TLS 1.3 | Encrypts the server certificate in the handshake | The certificate can no longer be used to identify the site | Rely on SNI and DNS for the hostname |
| Encrypted Client Hello (RFC 9849) | Hides the real hostname inside the handshake | SNI-based categorization stops working for sites that use it | DNS-layer filtering, endpoint agents, or inspection on managed devices |
| Encrypted DNS (DoH, DoT) | Encrypts name lookups, often to a resolver chosen by the app | The network resolver may never see the lookup | Manage the setting by policy and block unmanaged endpoints |
| QUIC and HTTP/3 | Web traffic over UDP with built-in encryption | Some inspection devices cannot decrypt it | Block UDP 443 so browsers fall back to TCP where inspection works |
Encrypted DNS is covered in its own guide: DNS over HTTPS and web filtering. For layered designs, see DNS filtering vs web filtering.
Rolling out category-based SSL inspection
Decryption breaks things when it is switched on everywhere at once. A staged rollout, guided by categories, keeps support calls low. Plan two to four weeks for a mid-size network, longer where many specialist apps are in use.
Run each stage long enough to cover a full working week, so monthly tools and occasional apps show up before you widen the scope.
- Deploy the root certificate to all managed devices first
- Start with a pilot group of IT staff
- Begin with high-risk categories only
- Set the exempt categories before widening scope
- Build a bypass list as broken apps appear
- Block QUIC so traffic uses inspectable TCP
- Give unmanaged devices domain-level rules only
- Publish a notice that explains what is inspected
- Watch processor load on the inspecting device
- Log decryption decisions with the category used
- Review exemptions each quarter with legal or privacy
- Retest after major browser and operating system updates
Block pages over HTTPS: if a session is blocked without decryption, the user sees a browser error, not your block page. Devices that trust your root certificate can be shown a proper page. For others, a clear error is the honest outcome.
Common breakages and how categories help fix them
Most problems after enabling inspection come from a small set of causes. Category rules fix many of them at once, instead of one domain at a time.
| Symptom | Likely cause | Fix |
|---|---|---|
| An app stops connecting right after rollout | The app pins its certificate and rejects the replacement | Add its hostnames to the bypass list, keep category logging on |
| Software updates fail on many machines | Update services check certificates strictly | Exempt the update services group, they are low risk and high volume |
| Video calls are choppy | Real-time traffic is decrypted and re-encrypted | Exempt meeting services and allow their media ports directly |
| Guest phones show certificate warnings | Unmanaged devices are being decrypted | Restrict inspection to managed device groups |
| Banking sites trigger complaints | Exemption list missing new or regional banks | Exempt by the Online Banking category, not by a hand-made list |
| Inspecting device runs hot at peak times | Streaming traffic is decrypted for no gain | Skip Streaming Media and similar low-risk, high-volume categories |
Inspection by audience
Businesses
- Inspect risky and data-sensitive categories
- Exempt banking and health
- Tell staff in the acceptable use policy
Schools
- Inspection often needed for safe search and video rules
- Managed student devices only
- Follow district and national guidance
MSPs
- One exemption baseline for all tenants
- Per-client bypass lists
- Root certificate rollout in onboarding scripts
Privacy, law and staff trust
Decrypting traffic means a device can read what people send and receive. That is a serious step, and it is regulated in many places. A category-based design is easier to defend because it shows that sensitive areas were left alone on purpose.
Purpose and proportion
Write down why inspection is needed, such as malware scanning and data loss prevention, and limit it to the categories that serve that purpose.
Notice
Tell users that web traffic may be inspected, which kinds of sites are exempt, and who can see the logs.
Access to logs
Full URL logs are more sensitive than domain logs. Limit who can view them and keep them only as long as needed.
Local rules
Employment, data protection and telecom laws differ by country and change over time. Check the current guidance for each site you operate.
How to tell if your policy works
| Measure | What a healthy result looks like |
|---|---|
| Share of sessions decrypted | Stable and explained by the categories you chose, not drifting up |
| Uncategorized share of inspected traffic | Small, and shrinking as data updates |
| Malware caught in decrypted traffic | Non-zero, showing inspection earns its cost |
| Bypass list size | Grows slowly, each entry with a reason |
| Complaints about exempt sites | Close to zero, a sign exemptions match real use |
For vendors: building decryption policy into your product
If you build firewalls, gateways or endpoint agents, category-driven decryption is one of the features customers configure most. The quality of the hostname categories underneath shapes how well it works.
Pre-built exemption groups
Ship a default "privacy-sensitive" group mapped to banking, health and similar categories so customers start from a safe baseline.
Fast local lookups
The category check happens on every new session, before decryption. It has to run from local data, not an outside call.
Daily updates
New domains arrive as daily delta files and the full set refreshes monthly, so exemptions and risk rules stay current.
Clear licensing
OEM licences let you embed the data in your product. See OEM licensing for terms.
Terms used on this page
SNI
Server Name Indication, the hostname a client sends at the start of a TLS handshake so the server knows which site is wanted.
Certificate pinning
An app accepts only specific certificates for its servers, so a replacement certificate from an inspecting device is rejected.
Bypass list
Hostnames or categories that pass through without decryption, usually for compatibility or privacy reasons.
Root certificate
The company certificate that managed devices trust, which lets the inspecting device sign replacement certificates for sites.
Our web filtering database ships as CSV, Parquet or JSON with a lookup API included, covering 120 million categorized domains in 59 categories.
Frequently asked questions
What is SSL inspection?
Decrypting HTTPS between a user and a website, checking it against policy and re-encrypting it. Managed devices trust the inspecting device through a company root certificate.
Why do URL categories matter for SSL inspection?
They decide which sessions are decrypted. Sensitive categories are exempted, risky ones are always inspected.
Can you filter HTTPS by category without decrypting it?
Yes, at domain level, using the hostname from DNS or the handshake. Paths and content need decryption.
What does Encrypted Client Hello change?
It hides the hostname in the handshake. Filters then rely more on DNS-layer categories, agents or full inspection on managed devices.
Which sites should not be decrypted?
Commonly banking, health, some government services and pinned apps. Check local law and your privacy policy.
Does SSL inspection slow the network?
It adds processing work. Skipping exempt and trusted high-volume categories keeps load manageable.
How is your category data licensed?
For internal use or embedded in products. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Make your decryption policy as good as its categories
License hostname categories for 120 million domains, with daily new-domain updates, to drive exemptions and inspection rules in your own systems.
License the database