> Source: [sk180317](https://support.checkpoint.com/results/sk/sk180317)

# sk180317 - SSL Inspection Bypass issues for Signal

| Property | Value |
|----------|-------|
| Solution ID | sk180317 |
| Date Created | 2022-11-27 |
| Last Modified | 2022-11-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- * Cannot set up bypass rule for SSL Inspection for the Signal connection.

* The certificate is untrusted.

* Traffic is shown as inspected even though there is no such rule.

## Cause

Signal uses a custom/private CA certificate to sign its own certificates. Browsing to [https://chat.signal.org/](chat.signal.org) without HTTPS Inspection results in a browser warning that the CA certificate is untrusted (NET::ERR_CERT_AUTHORITY_INVALID in Chrome).

In addition, Signal most likely relies upon certificate-pinning to prevent inspection. For it to function, its connections must be bypassed.

As Signal presents an untrusted certificate, HTTPS Inspection cannot rely on any information it carries for categorization purposes. We cannot trust it to be "[chat.signal.com](chat.signal.org)" because we have no trusted source which validates this information.

Performing categorization based on untrusted certificates is a security vulnerability. This means that it must be bypassed using its IP address. However, IP addresses of services can often change, which requires us to update the rule.

## Solution

As Signal uses UDP connections with random ports in addition to TCP over 443 (according to [their documentation](https://support.signal.org/hc/en-us/articles/360007320291-Firewall-and-Internet-settings)), bypassing it in HTTPS Inspection is not a complete solution. To allow Signal to function, all UDP traffic must be accepted in the Access Rule Base, which may be an additional security concern.

Domain objects were introduced to rely on passive DNS learning to track the IP addresses of each Domain. Support for this was added to HTTPS Inspection in R80.40 (both Security Gateway and Management Server must be R80.40 or higher).

**To bypass the Signal connection:**

Use a Domain object for "chat.signal.org" under the "**Destination**" column.

For more information on the domains that should be introduced to the Firewall bypass, refer to the Signal support page:  
<https://support.signal.org/hc/en-us/articles/360007320291-Firewall-and-Internet-settings>

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content