Systems and methods for automatic secure sockets layer (SSL) bypass
The present disclosure relates to systems and methods for automatically bypassing SSL connections responsive to client SSL handshake failures. Various embodiments include detecting a first failed client SSL connection, creating a cache entry including a traffic fingerprint of the first failed client SSL connection, and bypassing subsequent connections matching the cached fingerprint of the first failed client SSL connection. Embodiments further include cache entries that include a TTL, wherein connections can be matched to the entries during the configured TTL. The present systems and methods are provided to alleviate issues associated SSL traffic interruptions and breakdowns.
1. A method comprising steps of:
detecting a first failed client Secure Sockets Layer (SSL) connection based on a client SSL handshake error;
creating a cache entry including a traffic fingerprint derived from handshake metadata of the first failed client SSL connection; and
bypassing SSL inspection for subsequent connections matching the cached fingerprint of the first failed client SSL connection, without performing content-type determination or using destination-based bypass lists.
2. The method of claim 1 , wherein cache entries include a Time-To-Live (TTL), and wherein responsive to there being no cache entry matches within the TTL of the entry, creating a new entry.
3. The method of claim 2 , further comprising steps of:
incrementing a cache entry responsive to a connection matching the cached fingerprint of the first failed client SSL connection.
4. The method of claim 1 , wherein the steps are performed by an enforcement node of a cloud-based system.
5. The method of claim 1 , wherein the steps are only performed if an SSL inspection bypass rule is enabled.
6. The method of claim 5 , wherein responsive to the SSL inspection bypass rule being enabled, presenting a dropdown including a plurality of possible error codes for which a customer intends to bypass SSL traffic.
7. The method of claim 6 , wherein a connection is bypassed responsive to the connection matching one or more chosen error codes of the plurality of error codes.
8. The method of claim 1 , wherein cache entries are stored in a cache at an enforcement node in a cloud-based system.
9. The method of claim 8 , wherein the cache is not persisted.
10. The method of claim 1 , wherein the cache entry includes the reason why the client SSL connection failed.
11. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
detecting a first failed client Secure Sockets Layer (SSL) connection based on a client SSL handshake error;
creating a cache entry including a traffic fingerprint derived from handshake metadata of the first failed client SSL connection; and
bypassing SSL inspection for subsequent connections matching the cached fingerprint of the first failed client SSL connection, without performing content-type determination or using destination-based bypass lists.
12. The non-transitory computer-readable medium of claim 11 , wherein cache entries include a Time-To-Live (TTL), and wherein responsive to there being no cache entry matches within the TTL of the entry, creating a new entry.
13. The non-transitory computer-readable medium of claim 12 , further comprising steps of:
incrementing a cache entry responsive to a connection matching the cached fingerprint of the first failed client SSL connection.
14. The non-transitory computer-readable medium of claim 11 , wherein the steps are performed by an enforcement node of a cloud-based system.
15. The non-transitory computer-readable medium of claim 11 , wherein the steps are only performed if an SSL inspection bypass rule is enabled.
16. The non-transitory computer-readable medium of claim 15 , wherein responsive to the SSL inspection bypass rule being enabled, presenting a dropdown including a plurality of possible error codes for which a customer intends to bypass SSL traffic.
17. The non-transitory computer-readable medium of claim 16 , wherein a connection is bypassed responsive to the connection matching one or more chosen error codes of the plurality of error codes.
18. The non-transitory computer-readable medium of claim 11 , wherein cache entries are stored in a cache at an enforcement node in a cloud-based system.
19. The non-transitory computer-readable medium of claim 18 , wherein the cache is not persisted.
20. The non-transitory computer-readable medium of claim 11 , wherein the cache entry includes the reason why the client SSL connection failed.