將信任設定和 CA 集區設定新增至 TLS 檢查政策。
接著，這項政策會新增至防火牆端點關聯，用於解密攔截的流量。
CA 服務中儲存的 CA 會由硬體安全性模組 (HSM) 支援，並在每次使用時產生稽核記錄。
Cloud NGFW 產生的短期中繼 CA 只會儲存在記憶體中。中繼 CA 簽署的每個伺服器憑證都不會產生 CA 服務的稽核記錄。此外，由於伺服器憑證並非由 CA 服務直接產生，因此 CA 集區中設定的任何核發政策或名稱限制，都不會套用至 Cloud NGFW 產生的伺服器憑證。使用中繼 CA 產生伺服器憑證時，Cloud NGFW 不會強制執行這些限制。
防火牆政策規則 --tls-inspect 旗標
如要啟用與設定的防火牆政策規則相符的流量解密功能，請使用 --tls-inspect 旗標。在防火牆政策規則中設定 --tls-inspect 標記時，Cloud NGFW 會為相符的 TLS 流量產生新的伺服器憑證。Cloud NGFW 內的中繼 CA 會簽署這個憑證。這些中繼 CA 則是由 CA 服務中的 CA 集區簽署。接著，伺服器會向用戶端出示這項憑證，並建立 TLS 連線。系統會將產生的憑證快取一小段時間，以供後續連線至相同主機時使用。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eCloud Next Generation Firewall (NGFW) provides TLS interception and decryption to inspect both encrypted and unencrypted traffic for network threats on inbound and outbound connections.\u003c/p\u003e\n"],["\u003cp\u003eCloud NGFW decrypts TLS traffic to enable Layer 7 inspection, then re-encrypts it before forwarding it to the destination, using Google-managed Certificate Authority Service (CAS) to generate short-lived intermediate certificates.\u003c/p\u003e\n"],["\u003cp\u003eTo facilitate TLS inspection, users must set up Certificate Authority (CA) pools, and optionally trust configs, to manage trusted CA certificates, which are configured within a TLS inspection policy.\u003c/p\u003e\n"],["\u003cp\u003eCloud NGFW supports TLS protocol versions 1.0, 1.1, 1.2, and 1.3 and a wide array of cipher suites, as well as dynamically generating certificates for clients signed by intermediate CAs.\u003c/p\u003e\n"],["\u003cp\u003eTLS inspection in Cloud NGFW does not support HTTP/2, QUIC, HTTP/3, or PROXY protocol traffic.\u003c/p\u003e\n"]]],[],null,["# TLS inspection overview\n\nCloud Next Generation Firewall offers a Transport Layer Security (TLS) interception and\ndecryption service that can inspect encrypted and unencrypted traffic for\nnetwork attacks and disruptions. TLS connections are inspected on both inbound\nand outbound connections, including traffic to and from the internet and traffic\nwithin Google Cloud.\n\nCloud NGFW decrypts the TLS traffic to enable the firewall endpoint to\nperform Layer 7 inspection, such as [intrusion prevention](/firewall/docs/about-intrusion-prevention),\nin your network. After the inspection, Cloud NGFW re-encrypts the\ntraffic before sending it to its destination.\n\nCloud NGFW uses Google-managed [Certificate Authority Service (CAS)](/certificate-authority-service/docs)\nto generate short-lived intermediate certificates. Cloud NGFW uses\nthese intermediate certificates to generate the certificates that are required\nto decrypt the\nintercepted traffic. You set up [Certificate Authority (CA) pools](/certificate-authority-service/docs/ca-pool),\nand optionally, [trust configs](/certificate-manager/docs/core-components#trust-configs),\nto store and maintain a list of trusted CA certificates.\n\nThis page provides a detailed overview of Cloud NGFW's TLS\ninspection capabilities.\n\nSpecifications\n--------------\n\n- Cloud NGFW supports TLS protocol versions 1.0, 1.1, 1.2, and 1.3.\n\n- Cloud NGFW supports the following TLS cipher suites:\n\n \u003cbr /\u003e\n\n- Cloud NGFW uses a [TLS inspection policy](/firewall/docs/setup-tls-inspection#configure-tls-inspection-policy)\n to set up TLS inspection on a firewall endpoint.\n\n You set up CA pools and, optionally, trust configs to generate trusted TLS\n certificates for TLS clients. Optionally, you can also set up trust configs\n to store and maintain trusted CA certificates. You include the configuration\n information about CA pools and trust configs in a TLS inspection policy.\n This policy is then attached to the firewall endpoint and target\n Virtual Private Cloud (VPC) network and is used to decrypt the traffic\n you want to inspect.\n\n To learn more about how to set up TLS inspection in Cloud NGFW,\n see [Set up TLS inspection](/firewall/docs/setup-tls-inspection).\n- A TLS inspection policy and a CA pool are both regional resources. Therefore,\n you must create a CA pool and a TLS inspection policy for each region\n where you're enabling TLS inspection.\n\n- If you want to use trust configs in your TLS inspection policy, make sure the\n trust config and the TLS inspection policy are in the same region.\n\nRole of certificate authority in TLS inspection\n-----------------------------------------------\n\nCloud NGFW intercepts TLS traffic by dynamically generating certificates\nfor clients. These certificates are signed by intermediate CAs that are\nconfigured within\nthe firewall endpoint. These intermediate CAs are signed by CA pools within\nCA Service. Cloud NGFW generates new intermediate CAs every 24 hours.\n\nEach time a client establishes a TLS connection, Cloud NGFW\nintercepts\nthe connection and generates a certificate for the requested server name for the\nreturn back\nto the client. Cloud NGFW can also validate privately signed backend\ncertificates by using a trust config. You can add trusted certificates\nto a Certificate Manager trust config.\n\nYou add trust config and CA pool configurations to a TLS inspection policy.\nThis policy is then added to the [firewall endpoint association](/firewall/docs/about-firewall-endpoints#endpoint-association)\nand is used to decrypt the intercepted traffic.\n\nThe CAs stored in CA Service are backed by the Hardware\nSecurity Module (HSM) and generate audit logs with each use.\n\nThe short-lived intermediate CAs generated by Cloud NGFW are\nstored only in memory. Each server certificate signed by an intermediate CA\ndoes not result in an audit log from CA Service. Also,\nbecause server certificates are not generated directly by\nCA Service, any issuance policies or name constraints\nconfigured in the CA pool don't apply to server certificates generated\nby Cloud NGFW. Cloud NGFW does not enforce these\nconstraints when generating server certificates with intermediate CAs.\n| **Note:** If you use a CA pool with name constraints, it can result in the generation of invalid certificates by Cloud NGFW.\n\nFirewall policy rule `--tls-inspect` flag\n-----------------------------------------\n\nTo enable decryption of the traffic matching the configured firewall policy\nrules, use the `--tls-inspect` flag. When you configure the `--tls-inspect`\nflag in the firewall policy rule, Cloud NGFW generates a new server\ncertificate for matched TLS traffic. Intermediate CAs within\nCloud NGFW sign this certificate. These intermediate CAs are,\nin turn, signed by CA pools within CA Service. This certificate\nis then presented to the client, and a TLS connection is established. The\ngenerated certificate is cached for a short time for subsequent connections\nto the same host.\n\nTLS inspection over HTTP connect\n--------------------------------\n\nCloud NGFW supports TLS interception and decryption on the egress\nHTTPS traffic that a client sends by using\n[HTTP Connect](https://www.rfc-editor.org/rfc/rfc9110.html#section-9.3.6).\n\nFor example, consider a scenario where a client sends an HTTP Connect request\nto establish a secure tunnel between the client and server by using an intermediate web\nproxy server such as [Secure Web Proxy](/secure-web-proxy/docs/overview).\nAfter establishing the tunnel, Cloud NGFW intercepts and decrypts\nany egress TLS internet traffic that passes through the tunnel and performs a\nLayer 7 inspection like\n[intrusion detection and prevention](/firewall/docs/about-intrusion-prevention).\n\nLimitations\n-----------\n\n- Cloud NGFW doesn't support\n [HTTP/2](https://datatracker.ietf.org/doc/rfc9113/),\n [QUIC](https://datatracker.ietf.org/doc/rfc9000/),\n [HTTP/3](https://datatracker.ietf.org/doc/rfc9114/), or\n [PROXY protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n traffic with TLS inspection. However, TLS inspection is supported for TCP\n traffic that is not HTTPS.\n\n- Cloud NGFW supports only TLS decryption. It does not\n support decryption of traffic that uses other encryption protocols,\n such as SSH.\n\nWhat's next\n-----------\n\n- [Set up TLS inspection](/firewall/docs/setup-tls-inspection)"]]
