> Source: [sk184675](https://support.checkpoint.com/results/sk/sk184675)

# sk184675 - Inbound HTTPS Traffic Shows Bypass Logs and Delay When Inbound HTTPS Inspection Is Not Configured

| Property | Value |
|----------|-------|
| Solution ID | sk184675 |
| Date Created | 2026-02-20 |
| Last Modified | 2026-03-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Inbound HTTPS connections generate HTTPS Inspection "Bypass" log entries.
* Users experience delays when accessing internal HTTPS servers.
* No Inbound HTTPS Inspection policy is configured.
* Administrator does not intend to use Inbound HTTPS Inspection.
* Kernel debug on the Security Gateway may show entries such as:  
  * `rulebase match returned: POSSIBLE`
  * `rulebase contains outbound certificates only. probe is required`
  * `HTTPSI Bypass - flush stream due to TLS_MUX_FLAG_BYPASS`

## Cause

The Security Gateway evaluates the HTTPS Inspection policy as a single unified rulebase.

Processing flow:

1. The gateway evaluates Inbound HTTPS Inspection rules.
2. If there is no match, it evaluates Outbound HTTPS Inspection rules.
3. If an outbound rule contains certificate-based matching criteria (e.g., CN/SAN matchers, outbound certificate objects), the gateway performs a probe to determine certificate handling.
4. Even when the connection is ultimately bypassed, the probe runs first, which generates bypass logs and introduces a delay.

This behavior is **expected under these conditions**.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content