How SWG bar checks HTTPS inspection
Follow a domain from local observation to a TLS probe, macOS certificate trust evaluation, and the result shown in SWG bar and Chrome.
SWG bar · Updated
SWG bar combines a native Mac menu bar app, a local monitoring agent, and a TLS probe worker. The interface presents the result in four views: Overview, Domains, Certificates, and Plugins.
From a hostname to a result
- Find the domain. Local connection metadata and supported browser history sources help identify hostnames to inspect. Domain discovery is different from reading HTTPS content.
- Probe the TLS endpoint. The worker opens a separate TLS connection and collects certificate evidence. A probe is not a copy of the browser’s existing TLS session.
- Evaluate trust. The native agent uses macOS certificate trust evaluation and compares the chain with Apple’s public system roots.
- Show the evidence. The app associates the result with the domain and relevant certificates so you can inspect the issuer, root, and classification.
The current probe connects over TCP and IPv4. Observing other network metadata does not mean the probe reproduces every application’s IPv6, QUIC, proxy, or VPN behavior.
Local storage and network changes
Detection analysis and storage run on the Mac. The app uses a local SQLite database, encrypts selected sensitive stored fields, and uses a keyed domain index. This does not mean every file, log, or database field is encrypted.
Detection history can be cleared when the network changes or during an upgrade. Record any evidence you need to retain before changing the environment.
Licensing, update checks, and website purchases are separate from detection. Consult the privacy notice and terms for their details.
What the Chrome extension reads
The Chrome extension communicates with SWG bar through Chrome native messaging. It reads results that the Mac app already holds for the relevant domain. It does not extract Chrome’s live TLS certificate and does not independently run a new TLS probe.
How to use a classification
Treat the classification as a starting point for examining the supporting chain. Local trust can be intentional, especially for private services. A public chain also does not prove that traffic bypassed a gateway; it may indicate an inspection exception.
Use the detection guide for a repeatable check and the comparison guide for the difference between routing and decryption.