Systems and methods for automatic secure sockets layer (SSL) bypass

Patent metadata

Field	Value
Publication number	US-12438732-B2
Application number	US-202318318496-A
Country	US
Kind code	B2
Filing date	May 16, 2023
Priority date	Apr 30, 2020
Publication date	Oct 7, 2025
Grant date	Oct 7, 2025

Abstract

The present disclosure relates to systems and methods for automatically bypassing SSL connections responsive to client SSL handshake failures. Various embodiments include detecting a first failed client SSL connection, creating a cache entry including a traffic fingerprint of the first failed client SSL connection, and bypassing subsequent connections matching the cached fingerprint of the first failed client SSL connection. Embodiments further include cache entries that include a TTL, wherein connections can be matched to the entries during the configured TTL. The present systems and methods are provided to alleviate issues associated SSL traffic interruptions and breakdowns.

First claim

What is claimed is:

1. A method comprising steps of:
detecting a first failed client Secure Sockets Layer (SSL) connection based on a client SSL handshake error;
creating a cache entry including a traffic fingerprint derived from handshake metadata of the first failed client SSL connection; and
bypassing SSL inspection for subsequent connections matching the cached fingerprint of the first failed client SSL connection, without performing content-type determination or using destination-based bypass lists.

2. The method of claim 1 , wherein cache entries include a Time-To-Live (TTL), and wherein responsive to there being no cache entry matches within the TTL of the entry, creating a new entry.

3. The method of claim 2 , further comprising steps of:
incrementing a cache entry responsive to a connection matching the cached fingerprint of the first failed client SSL connection.

4. The method of claim 1 , wherein the steps are performed by an enforcement node of a cloud-based system.

5. The method of claim 1 , wherein the steps are only performed if an SSL inspection bypass rule is enabled.

6. The method of claim 5 , wherein responsive to the SSL inspection bypass rule being enabled, presenting a dropdown including a plurality of possible error codes for which a customer intends to bypass SSL traffic.

7. The method of claim 6 , wherein a connection is bypassed responsive to the connection matching one or more chosen error codes of the plurality of error codes.

8. The method of claim 1 , wherein cache entries are stored in a cache at an enforcement node in a cloud-based system.

9. The method of claim 8 , wherein the cache is not persisted.

10. The method of claim 1 , wherein the cache entry includes the reason why the client SSL connection failed.

11. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
detecting a first failed client Secure Sockets Layer (SSL) connection based on a client SSL handshake error;
creating a cache entry including a traffic fingerprint derived from handshake metadata of the first failed client SSL connection; and
bypassing SSL inspection for subsequent connections matching the cached fingerprint of the first failed client SSL connection, without performing content-type determination or using destination-based bypass lists.

12. The non-transitory computer-readable medium of claim 11 , wherein cache entries include a Time-To-Live (TTL), and wherein responsive to there being no cache entry matches within the TTL of the entry, creating a new entry.

13. The non-transitory computer-readable medium of claim 12 , further comprising steps of:
incrementing a cache entry responsive to a connection matching the cached fingerprint of the first failed client SSL connection.

14. The non-transitory computer-readable medium of claim 11 , wherein the steps are performed by an enforcement node of a cloud-based system.

15. The non-transitory computer-readable medium of claim 11 , wherein the steps are only performed if an SSL inspection bypass rule is enabled.

16. The non-transitory computer-readable medium of claim 15 , wherein responsive to the SSL inspection bypass rule being enabled, presenting a dropdown including a plurality of possible error codes for which a customer intends to bypass SSL traffic.

17. The non-transitory computer-readable medium of claim 16 , wherein a connection is bypassed responsive to the connection matching one or more chosen error codes of the plurality of error codes.

18. The non-transitory computer-readable medium of claim 11 , wherein cache entries are stored in a cache at an enforcement node in a cloud-based system.

19. The non-transitory computer-readable medium of claim 18 , wherein the cache is not persisted.

20. The non-transitory computer-readable medium of claim 11 , wherein the cache entry includes the reason why the client SSL connection failed.

Assignees

• Zscaler Inc

Inventors

• Pergament Lidor
• Devarajan Srikanth
• Maheshwari Akshat

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title