# What does TLS inspection on a firewall break?

More than people expect. To inspect HTTPS, the firewall or proxy ends each connection, decrypts it, inspects it and opens a new encrypted connection to the real server, presenting its own certificate signed by a company root installed on every managed device. The side effects: apps with certificate pinning, many updaters, some banking and health apps and parts of cloud services refuse the substitute certificate, so exception lists keep growing; unmanaged devices, guests and machines cannot be inspected at all; the proxy becomes one place that holds decrypted traffic, including personal data, which raises GDPR and works-council questions; older proxies may not support recent TLS features or the new hybrid post-quantum groups and quietly weaken connections; and inspection costs performance. It still has its place, for example scanning downloads on managed laptops. But many threats are visible without it. NetSenX takes that approach: it never decrypts and works from metadata and the unencrypted handshake.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-does-tls-inspection-on-a-firewall-break

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can deep packet inspection work on encrypted traffic?](https://netsenx.com/en/faq/can-deep-packet-inspection-work-on-encrypted-traffic)
- [Can malware be detected from flow statistics alone?](https://netsenx.com/en/faq/can-malware-be-detected-from-flow-statistics)
- [Can encrypted traffic reveal what is inside it?](https://netsenx.com/en/faq/can-encrypted-traffic-reveal-what-is-inside)
- [Is network metadata personal data under GDPR?](https://netsenx.com/en/faq/is-network-metadata-personal-data-under-gdpr)
- [Can you get malware from an HTTPS website?](https://netsenx.com/en/faq/can-you-get-malware-from-an-https-website)