您可以将信任配置和 CA 池配置添加到 TLS 检查政策。然后，此政策会被添加到防火墙端点关联，并用于解密拦截的流量。
存储在 CA Service 中的 CA 由硬件安全模块 (HSM) 提供支持，并在每次使用时生成审核日志。
由 Cloud NGFW 生成的短期有效中间 CA 仅存储在内存中。由中间 CA 签名的每个服务器证书都不会导致生成 CA Service 的审核日志。此外，由于服务器证书不是由 CA Service 直接生成的，因此 CA 池中配置的任何颁发政策或名称限制条件都不适用于 Cloud NGFW 生成的服务器证书。使用中间 CA 生成服务器证书时，Cloud NGFW 不会强制执行这些限制条件。
防火墙政策规则 --tls-inspect 标志
如需对与配置的防火墙政策规则匹配的流量进行解密，请使用 --tls-inspect 标志。在防火墙政策规则中配置 --tls-inspect 标志后，Cloud NGFW 会为匹配的 TLS 流量生成新的服务器证书。Cloud NGFW 中的中间 CA 会签署此证书。这些中间 CA 又由 CA Service 中的 CA 池签名。然后，该证书将提供给客户端，并建立 TLS 连接。生成的证书会缓存一小段时间，以便后续连接到同一主机。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-04-30。"],[[["\u003cp\u003eCloud Next Generation Firewall (NGFW) provides TLS interception and decryption to inspect both encrypted and unencrypted traffic for network threats on inbound and outbound connections.\u003c/p\u003e\n"],["\u003cp\u003eCloud NGFW decrypts TLS traffic to enable Layer 7 inspection, then re-encrypts it before forwarding it to the destination, using Google-managed Certificate Authority Service (CAS) to generate short-lived intermediate certificates.\u003c/p\u003e\n"],["\u003cp\u003eTo facilitate TLS inspection, users must set up Certificate Authority (CA) pools, and optionally trust configs, to manage trusted CA certificates, which are configured within a TLS inspection policy.\u003c/p\u003e\n"],["\u003cp\u003eCloud NGFW supports TLS protocol versions 1.0, 1.1, 1.2, and 1.3 and a wide array of cipher suites, as well as dynamically generating certificates for clients signed by intermediate CAs.\u003c/p\u003e\n"],["\u003cp\u003eTLS inspection in Cloud NGFW does not support HTTP/2, QUIC, HTTP/3, or PROXY protocol traffic.\u003c/p\u003e\n"]]],[],null,["# TLS inspection overview\n\nCloud Next Generation Firewall offers a Transport Layer Security (TLS) interception and\ndecryption service that can inspect encrypted and unencrypted traffic for\nnetwork attacks and disruptions. TLS connections are inspected on both inbound\nand outbound connections, including traffic to and from the internet and traffic\nwithin Google Cloud.\n\nCloud NGFW decrypts the TLS traffic to enable the firewall endpoint to\nperform Layer 7 inspection, such as [intrusion prevention](/firewall/docs/about-intrusion-prevention),\nin your network. After the inspection, Cloud NGFW re-encrypts the\ntraffic before sending it to its destination.\n\nCloud NGFW uses Google-managed [Certificate Authority Service (CAS)](/certificate-authority-service/docs)\nto generate short-lived intermediate certificates. Cloud NGFW uses\nthese intermediate certificates to generate the certificates that are required\nto decrypt the\nintercepted traffic. You set up [Certificate Authority (CA) pools](/certificate-authority-service/docs/ca-pool),\nand optionally, [trust configs](/certificate-manager/docs/core-components#trust-configs),\nto store and maintain a list of trusted CA certificates.\n\nThis page provides a detailed overview of Cloud NGFW's TLS\ninspection capabilities.\n\nSpecifications\n--------------\n\n- Cloud NGFW supports TLS protocol versions 1.0, 1.1, 1.2, and 1.3.\n\n- Cloud NGFW supports the following TLS cipher suites:\n\n \u003cbr /\u003e\n\n- Cloud NGFW uses a [TLS inspection policy](/firewall/docs/setup-tls-inspection#configure-tls-inspection-policy)\n to set up TLS inspection on a firewall endpoint.\n\n You set up CA pools and, optionally, trust configs to generate trusted TLS\n certificates for TLS clients. Optionally, you can also set up trust configs\n to store and maintain trusted CA certificates. You include the configuration\n information about CA pools and trust configs in a TLS inspection policy.\n This policy is then attached to the firewall endpoint and target\n Virtual Private Cloud (VPC) network and is used to decrypt the traffic\n you want to inspect.\n\n To learn more about how to set up TLS inspection in Cloud NGFW,\n see [Set up TLS inspection](/firewall/docs/setup-tls-inspection).\n- A TLS inspection policy and a CA pool are both regional resources. Therefore,\n you must create a CA pool and a TLS inspection policy for each region\n where you're enabling TLS inspection.\n\n- If you want to use trust configs in your TLS inspection policy, make sure the\n trust config and the TLS inspection policy are in the same region.\n\nRole of certificate authority in TLS inspection\n-----------------------------------------------\n\nCloud NGFW intercepts TLS traffic by dynamically generating certificates\nfor clients. These certificates are signed by intermediate CAs that are\nconfigured within\nthe firewall endpoint. These intermediate CAs are signed by CA pools within\nCA Service. Cloud NGFW generates new intermediate CAs every 24 hours.\n\nEach time a client establishes a TLS connection, Cloud NGFW\nintercepts\nthe connection and generates a certificate for the requested server name for the\nreturn back\nto the client. Cloud NGFW can also validate privately signed backend\ncertificates by using a trust config. You can add trusted certificates\nto a Certificate Manager trust config.\n\nYou add trust config and CA pool configurations to a TLS inspection policy.\nThis policy is then added to the [firewall endpoint association](/firewall/docs/about-firewall-endpoints#endpoint-association)\nand is used to decrypt the intercepted traffic.\n\nThe CAs stored in CA Service are backed by the Hardware\nSecurity Module (HSM) and generate audit logs with each use.\n\nThe short-lived intermediate CAs generated by Cloud NGFW are\nstored only in memory. Each server certificate signed by an intermediate CA\ndoes not result in an audit log from CA Service. Also,\nbecause server certificates are not generated directly by\nCA Service, any issuance policies or name constraints\nconfigured in the CA pool don't apply to server certificates generated\nby Cloud NGFW. Cloud NGFW does not enforce these\nconstraints when generating server certificates with intermediate CAs.\n| **Note:** If you use a CA pool with name constraints, it can result in the generation of invalid certificates by Cloud NGFW.\n\nFirewall policy rule `--tls-inspect` flag\n-----------------------------------------\n\nTo enable decryption of the traffic matching the configured firewall policy\nrules, use the `--tls-inspect` flag. When you configure the `--tls-inspect`\nflag in the firewall policy rule, Cloud NGFW generates a new server\ncertificate for matched TLS traffic. Intermediate CAs within\nCloud NGFW sign this certificate. These intermediate CAs are,\nin turn, signed by CA pools within CA Service. This certificate\nis then presented to the client, and a TLS connection is established. The\ngenerated certificate is cached for a short time for subsequent connections\nto the same host.\n\nTLS inspection over HTTP connect\n--------------------------------\n\nCloud NGFW supports TLS interception and decryption on the egress\nHTTPS traffic that a client sends by using\n[HTTP Connect](https://www.rfc-editor.org/rfc/rfc9110.html#section-9.3.6).\n\nFor example, consider a scenario where a client sends an HTTP Connect request\nto establish a secure tunnel between the client and server by using an intermediate web\nproxy server such as [Secure Web Proxy](/secure-web-proxy/docs/overview).\nAfter establishing the tunnel, Cloud NGFW intercepts and decrypts\nany egress TLS internet traffic that passes through the tunnel and performs a\nLayer 7 inspection like\n[intrusion detection and prevention](/firewall/docs/about-intrusion-prevention).\n\nLimitations\n-----------\n\n- Cloud NGFW doesn't support\n [HTTP/2](https://datatracker.ietf.org/doc/rfc9113/),\n [QUIC](https://datatracker.ietf.org/doc/rfc9000/),\n [HTTP/3](https://datatracker.ietf.org/doc/rfc9114/), or\n [PROXY protocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n traffic with TLS inspection. However, TLS inspection is supported for TCP\n traffic that is not HTTPS.\n\n- Cloud NGFW supports only TLS decryption. It does not\n support decryption of traffic that uses other encryption protocols,\n such as SSH.\n\nWhat's next\n-----------\n\n- [Set up TLS inspection](/firewall/docs/setup-tls-inspection)"]]
