Troubleshoot TLS inspection errors

This page describes how to diagnose and resolve common issues that might occur when you enable TLS inspection for Secure Web Proxy.

TLS inspection is enabled but traffic is blocked

To fix this issue, do the following:

Make sure that you have granted the necessary Identity and Access Management (IAM) permissions to the service account in your Google Cloud project so that it can access the Certificate Authority Service.
Verify that you have defined a valid ApplicationMatcher by using the CEL matcher language to correctly identify the traffic for decryption.
Check that your client devices trust the certificate authority (CA) pool your Secure Web Proxy instance uses; without this trust, connections can be terminated with SSL/TLS handshake errors.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-27 UTC.