Create a rule-based decryption policy

A decryption policy is a rule-based security policy that controls how encrypted network traffic is handled.

Create decryption policy to protect outbound and inbound network connections through various rule actions.

You can create any of these types of decryption policies:

  • Outbound protection policy with rules that protect outbound connections. The destination server is outside your protected network. This type of rule has a Decrypt - Resign rule action. We also create additional rules with a Do Not Decrypt action that excludes traffic you specify (such as traffic that uses certificate pinning).

    Refer to Create a rule-based decryption policy with outbound connection protection for guidance on creating a decryption rule with outbound connection.

  • Inbound protection policy with a rule that protects inbound connections; that is, the destination server is inside your protected network. This type of rule has a Decrypt - Known Key rule action. We also create additional rules with a Do Not Decrypt action that excludes traffic you specify (such as traffic that uses certificate pinning.) These rules are disabled initially but you can modify and enable them later if you wish.

    Refer to Create a rule-based decryption policy with inbound connection protection or guidance on creating a decryption rule with inbound connection.

  • Other actions (including Do Not Decrypt, Block, and Block with Reset).

    See Create a rule-based decryption policy with other rule actions