Source: https://swgbar.com/en/guides/swg-bypass-vs-tls-exception/
Language: en

# SWG bypass vs. a TLS inspection exception

Understand the difference between routing around a secure web gateway and keeping gateway routing while excluding a site from HTTPS decryption.

SWG bar · Updated October 23, 2026

**SWG bypass changes the route taken by a connection. A TLS inspection exception changes whether a gateway decrypts that connection.** Both can result in seeing a public certificate chain, but they are different outcomes.

## What changes in each case?

| Question | Gateway bypass | TLS inspection exception |
| --- | --- | --- |
| Does traffic still traverse the gateway? | The selected connection uses a different route, if that route is available. | Yes; the gateway can forward the encrypted connection. |
| Can the original public certificate appear? | Yes, when the destination is reached directly without another intercepting service. | Yes, because the gateway does not replace the certificate for that connection. |
| Can access controls still apply? | Other controls on the device or network may still apply. | Gateway routing and applicable access controls can remain in place. |
| What must be checked? | Route, reachability, and fresh certificate evidence. | The effective exception and fresh certificate evidence. |

## Why the certificate alone cannot identify the route

A certificate describes the TLS peer and its trust chain. It does not list every device forwarding the packets. If a secure web gateway tunnels encrypted traffic without terminating TLS, a client can see the same public chain that it sees on a direct connection.

Similarly, a locally trusted root does not identify a particular gateway vendor. It can belong to an organization’s inspection system, a debugging proxy, or a private service.

## Choose the change that matches the problem

For an application affected by TLS inspection, a narrowly scoped administrator-managed decryption exception may solve compatibility problems while preserving the intended network route. If you are evaluating an alternative route on a network you administer or are authorized to test, verify that the connection actually uses it; changing a proxy preference does not guarantee that endpoint or network routing changes with it.

Use [the HTTPS inspection checklist](<https://swgbar.com/en/guides/detect-https-inspection/>) to compare results. Record the exact host and the application used so that a successful test in one application is not mistaken for a result covering every application.

## What SWG bar contributes

SWG bar makes domain and certificate evidence easier to inspect from the Mac menu bar. Its result concerns the observed or probed connection, not a blanket assertion that every gateway control has disappeared. [How it works](<https://swgbar.com/en/how-it-works/>) explains that boundary in more detail.

## Keep reading

*   [How to bypass SWG on a Mac](<https://swgbar.com/en/guides/how-to-bypass-swg/>)
*   [How to detect HTTPS inspection on a Mac](<https://swgbar.com/en/guides/detect-https-inspection/>)
*   [How SWG bar checks HTTPS inspection](<https://swgbar.com/en/how-it-works/>)
*   [Install SWG bar on your Mac](<https://swgbar.com/en/install/>)
*   [Connect the SWG bar Chrome extension](<https://swgbar.com/en/chrome-extension/>)
*   [SWG bar CLI Guide](<https://swgbar.com/en/cli/>)
*   [SWG bar MCP Guide](<https://swgbar.com/en/mcp/>)
*   [SWG bar release information](<https://swgbar.com/en/releases/>)
*   [About SWG bar](<https://swgbar.com/en/about/>)