Troubleshoot TLS inspection errors

This page describes how to diagnose and resolve common issues that might occur when you enable TLS inspection for Secure Web Proxy .

TLS inspection is enabled but traffic is blocked

To fix this issue, do the following:

1. Make sure that you have granted the necessary Identity and Access Management (IAM) permissions to the service account in your Google Cloud project so that it can access the Certificate Authority Service.

2. Verify that you have defined a valid ApplicationMatcher by using the CEL matcher language to correctly identify the traffic for decryption.

3. Check that your client devices trust the certificate authority (CA) pool your Secure Web Proxy instance uses; without this trust, connections can be terminated with SSL/TLS handshake errors.

What's next

• Secure Web Proxy release notes
• Secure Web Proxy support