Enter a Hostname to
define a custom decryption exclusion. The firewall compares the
hostname to the SNI requested by the client or to the CN presented
in the server certificate. The firewall excludes sessions in which
the server presents a CN that contains the defined domain from decryption. You can use asterisks (*) as wildcards to create decryption exclusions for multiple hostnames
associated with a domain. Asterisks behave the same way that carets
(^) behave for URL category
exceptions—each asterisk controls one variable subdomain
(label) in the hostname. This enables you to create both very
specific and very general exclusions. For example: mail.*.com matches mail.company.com but does not match mail.company.sso.com *.company.com matches tools.company.com but does not match eng.tools.company.com *.*.company.com matches eng.tools.company.com but does not match eng.company.com *.*.*.company.com matches corp.exec.mail.company.com but does not match corp.mail.company.com mail.google.* matches mail.google.com but does not match mail.google.uk.com mail.google.*.* matches mail.google.co.uk but does not match mail.google.com
To exclude video-stats.video.google.com from decryption but not video.google.com, add
*.*.google.com to the SSL Decryption Exclusion list. Hostnames should be unique for each entry. If a predefined entry is delivered to the firewall
that matches an existing custom entry, the custom entry takes
precedence. You cannot edit the Hostname for a
predefined decryption exclusion. |