Cisco Cisco Web Security Appliance S690 User Guide

Decryption policies define the handling of HTTPS traffic within the web proxy:

When to decrypt HTTPS traffic.

How to handle requests that use invalid or revoked security certificates.

You can create decryption policies to handle HTTPS traffic in the following ways:

Pass through encrypted traffic

Decrypt traffic and apply the content-based access policies defined for HTTP traffic. This also 
makes malware scanning possible.

Drop the HTTPS connection

Monitor the request (take no final action) as the web proxy continues to evaluate the request against 
policies that may lead to a final drop, pass through, or decrypt action.

Handle personally identifiable information with care: If you choose to decrypt an end-user’s HTTPS 
session, the Web Security appliance access logs and reports may contain personally identifiable 
information. The Administrator can configure how much URI text is stored in the logs using the 

advancedproxyconfig

 CLI command and the 

HTTPS

 subcommand. You can log the entire URI, or a 

partial form of the URI with the query portion removed. However, even when you choose to strip the 
query from the URI, personally identifiable information may still remain.