Справочник Пользователя для SonicWALL 5.8.1

On the User Object/Group line, select a user object or group from the Exclude pulldown 
menu to exempt it from DPI-SSL inspection.

The Include pulldown menu can be used to fine tune the specified exclusion list. For 
example, by selecting the Remote-office-California address object in the Exclude 
pulldown and the Remote-office-Oakland address object in the Include pulldown. 

Server DPI-SSL inspection requires that you specify which certificate will be used to sign traffic 
for each server that will have DPI-SSL inspection performed on its traffic. To configure a server-
to-certificate pairing, perform the following steps:

Navigate to the DPI-SSL > Server SSL page and scroll down to the SSL Servers section.

Click the Add button.

In the Address Object/Group pulldown menu, select the address object or group for the 
server or servers that you want to apply DPI-SSL inspection to.

In the SSL Certificate pulldown menu, select the certificate that will be used to sign the 
traffic for the server. For more information on importing a new certificate to the appliance, 
see

. For information on 

creating a certificate, see 

Select the Cleartext checkbox to enable SSL offloading. See 

for more information.

Click Add.

When adding server-to-certificate pairs, a cleartext option is available. This option indicates 
that the portion of the TCP connection between the UTM appliance and the local server will be 
in the clear without SSL layer, thus allowing SSL processing to be offloaded from the server by 
the appliance.

Please note that in order for such configuration to work properly, a NAT policy needs to be 
created on the Network > NAT Policies page to map traffic destined for the offload server from 
an SSL port to a non-SSL port. For example, in case of HTTPS traffic being used with SSL 
offloading, an inbound NAT policy remapping traffic from port 443 to port 80 needs to be 
created in order for things to work properly.