@rclavero @mzhang

@sshiflett @amurugesan @mkoyfman 

Hello everyone, good afternoon, excuse me for referencing you but please can you support me with the post please.

I remain attentive to your kind comments

Thank you

Best regards

Hi MetgatzNK,

most of the android users are accessing the content using the native android apps. Most of them are cert pinned app applications. Popular domains are consumed from those apps but also from  browsers, so instead of asking the admins to create DnD (Don't decrypt) rules just for cert pinned apps, it's simpler to leverage a general exception for that access method. 

This is the reason you are seeing android client sourced traffic matching a generic DND policy.

Hth,

Roberto

Hello @rclavero , thank you for your reply.

Yes, I understand what I commented, but at this point, the log that I commented above, this log was not based on any particular application, but simply all queries to websites, through the Android web browser, ie Firefox, Chrome, Brave, native web browser.

Moreover, this rule does not appear in the list of SSL default rules, but if Netskope is applying it, it is a base rule but it does not exist, it was not declared and was not created by us and it applies to websites, not SaaS applications, but to any site of the traditional type to all.

Thank you, I remain attentive

Best regards

Hi,

as I mentioned before this is something we have configured for you. There's no way to identify if the traffic is being sourced from the native app or the browser. So the traffic needs to be don't decrypted. The policy isn't visible for you because it's applied on the backend. 

Hth,

Roberto Clavero

@MetgatzNK just to add some more context to this.  The default do not decrypt for Android exists as the operating system has restrictions on importing root certificates.  In general you must add a certificate to each app for it to trust a certificate for SSL inspection.  The do not decrypt activates when Android traffic is sent to Netskope on a device where we don't detect the Netskope certificates imported.  You can import the Netskope certificate to an Android device and then we can intercept and inspect traffic from the browser.  Other apps may require additional configuration or will need to be bypassed from SSL inspection via a certificate pinned bypass in the Steering Configuration.  In short, it is possible to inspect traffic from Android devices but requires additional configuration.    I'd suggest reaching out to your local Netskope account team or potentially professional services if this is an enterprise deployment.  Hope this helps and apologies for the delay!