Check Point HTTPS Inspection Bypass Miss: tls_inspect When One Site Still Warns

Check Point · Techclick CLI troubleshooting lab

You added a bypass for a vendor site. Users still get a Check Point certificate warning.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Check Point for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Bypass must match the SNI/category on the inspection policy, not only the access rule. Verify with https_inspection / tls logs.

Why this ticket shows up

Access policy allow and HTTPS inspection are different layers. A bypass in the wrong layer never fires.

Symptoms operators actually see

• Warning remains

• Bypass object looks correct

• SNI is a CDN name, not the brand name

• Category still inspect

CLI first — copy this block

Run these on the Check Point device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

fw tab -t https_inspection_cache -u | head
fw ctl zdebug + drop | grep inspect
# on R81+ also:
cpstat fw
cat $FWDIR/log/https_inspection* 2>/dev/null | tail

How to read that output

If the session is still marked inspect, your bypass object does not match the SNI the gateway sees. CDN hostnames are the usual miss.

Triage order

1. Read the SNI from the client or log

2. Put that exact FQDN in the bypass

3. Install policy

4. Retest

5. Do not disable HTTPS inspection globally

Classic traps

What you see	Real cause	Fix
Bypass the whole category Internet	One CDN name	Bypass the FQDN
Change the access rule	Inspection layer is separate	Edit inspection
Install without policy	Old inspect decision cached	Install and retest

Proof the ticket is closed

• Certificate is the real site issuer or an intentional bypass

• Inspection stays on for other sites

• No global disable

Say this in an interview

HTTPS inspection bypass lives in the inspection layer. I match SNI, not the marketing hostname.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/