SWG bypass vs. a TLS inspection exception
Understand the difference between routing around a secure web gateway and keeping gateway routing while excluding a site from HTTPS decryption.
SWG bar · Updated
SWG bypass changes the route taken by a connection. A TLS inspection exception changes whether a gateway decrypts that connection. Both can result in seeing a public certificate chain, but they are different outcomes.
What changes in each case?
| Question | Gateway bypass | TLS inspection exception |
|---|---|---|
| Does traffic still traverse the gateway? | The selected connection uses a different route, if that route is available. | Yes; the gateway can forward the encrypted connection. |
| Can the original public certificate appear? | Yes, when the destination is reached directly without another intercepting service. | Yes, because the gateway does not replace the certificate for that connection. |
| Can access controls still apply? | Other controls on the device or network may still apply. | Gateway routing and applicable access controls can remain in place. |
| What must be checked? | Route, reachability, and fresh certificate evidence. | The effective exception and fresh certificate evidence. |
Why the certificate alone cannot identify the route
A certificate describes the TLS peer and its trust chain. It does not list every device forwarding the packets. If a secure web gateway tunnels encrypted traffic without terminating TLS, a client can see the same public chain that it sees on a direct connection.
Similarly, a locally trusted root does not identify a particular gateway vendor. It can belong to an organization’s inspection system, a debugging proxy, or a private service.
Choose the change that matches the problem
For an application affected by TLS inspection, a narrowly scoped administrator-managed decryption exception may solve compatibility problems while preserving the intended network route. If you are evaluating an alternative route on a network you administer or are authorized to test, verify that the connection actually uses it; changing a proxy preference does not guarantee that endpoint or network routing changes with it.
Use the HTTPS inspection checklist to compare results. Record the exact host and the application used so that a successful test in one application is not mistaken for a result covering every application.
What SWG bar contributes
SWG bar makes domain and certificate evidence easier to inspect from the Mac menu bar. Its result concerns the observed or probed connection, not a blanket assertion that every gateway control has disappeared. How it works explains that boundary in more detail.