Phase in decryption. You can accomplish this several ways. You
can decrypt the highest priority traffic first (for example, the
URL Categories most likely to harbor malicious traffic, such as
gaming) and then decrypt more as you gain experience. Alternatively,
you can take a more conservative approach and decrypt the URL Categories
that don’t affect your business first (so if something goes wrong,
no issues occur that affect business), for example, news feeds.
In all cases, the best way to phase in decryption is to decrypt
a few URL Categories, take user feedback into account, run reports
to ensure that decryption is working as expected, and then gradually
decrypt a few more URL Categories and verify, and so on. Plan to
make
Decryption
Exclusions to exclude sites from decryption if you can’t
decrypt them for technical reasons or because you choose not to
decrypt them.
If you
Enable
Users to Opt Out of SSL Decryption (users see a response
page that allows them either to opt out of decryption and end the session
without going to the site or to proceed to the site and agree to
have the traffic decrypted), educate them about what it is, why
they’re seeing it, and what their options are.