How to Enable SSL/TLS Inspection for GenAI Traffic in Cato

Overview

To see and control which AI tools your users are actually using, enable TLS Inspection account-wide under Security > TLS Inspection, install the Cato root certificate on every managed device, then add an Inspect rule scoped to the Generative AI Tools application category. Until TLS Inspection is enabled for that traffic, Cato can identify the AI site but cannot see what is happening inside it — app activities, file uploads and DLP matches all stay invisible, and any Application Control rule written against a specific AI application will not match.

Applies to

• Cato SASE Cloud, Cato Management Application (CMA), September 2026 navigation

• CASB license required for the GenAI Apps dashboard and app activity controls; DLP license required for data-protection rules

• Cato Client on Windows and macOS, and site-connected traffic via Socket

• Admin role with permission to edit Security policies and Certificate Management

• Not supported on Android; Linux and unidentified OS are bypassed by default

Before you start

• Know which AI tools are already in use — check Resources > App Catalog and the Security > GenAI Apps dashboard first, so you are scoping inspection to real traffic rather than guessing.

• Have a pilot group ready (one network, one site, or a handful of VPN users). Do not turn inspection on for the whole account as your first move.

• Plan certificate distribution before the policy change, not after.

Caution: Enabling TLS Inspection changes how every inspected TLS session is presented to the endpoint. Applications that use certificate pinning will fail outright — see fixing Cato TLS inspection application failures for the bypass pattern — and command-line tools and SDKs with their own certificate stores will throw TLS errors until they trust the Cato root CA. Roll out to a pilot group first.

Why AI traffic is invisible without inspection

Every mainstream GenAI tool is HTTPS-only. Without TLS inspection, Cato sees the SNI and the destination — enough to classify the session as ChatGPT or Claude or Gemini and to allow or block the whole domain, and nothing more. The prompt body, the file being pasted in, the tenant the user signed into, and whether they uploaded a customer list are all inside the encrypted payload.

That is why Cato's documentation states plainly, for the Application Control policy: "For application rules, you must enable TLS Inspection to inspect the traffic that matches the rule", and again: "For category rules with a defined activity, you must enable TLS Inspection to inspect the traffic that matches the rule." Activity-level control over AI apps — block upload, allow chat, restrict login to the corporate tenant — is a decryption-dependent feature. So is inline DLP.

There is a second consequence that catches teams out: traffic matched by a TLS Inspection bypass rule is also excluded from the anti-malware and threat-prevention engines. A broad bypass written to keep one AI tool working silently removes that traffic from security scanning as well.

Step 1 — Download the Cato root certificate

1. In the Cato Management Application, go to Security > Certificate Management.

2. Download the Cato root certificate. DER format is available from the Actions menu; PEM is available from the same page. A CER copy is also available from the Client download portal.

3. Keep the PEM file — CatoNetworksTrustedRootCA.pem — aside. You will need it for developer machines in Step 6.

Step 2 — Distribute the certificate to managed devices

The certificate must be trusted by the endpoint before inspection reaches it, or users get certificate warnings on every AI tool.

Windows

• With the Cato Client installed, the certificate is added to the Windows certificate store automatically, which covers Chrome and Edge.

• For fleet-wide deployment independent of the Client, import the DER certificate by Group Policy under Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies, into the Trusted Root Certification Authorities store.

macOS

• In MDM-managed estates the Cato certificate is installed into the CA keychain as part of the MDM profile.

• Without MDM, the user installs it manually — plan for this, it is the usual source of pilot noise.

If you manage devices with JumpCloud, push the PEM as a configuration profile or policy at the same time you push the Cato Client — see deploying the Cato Client via JumpCloud — so trust and inspection land together rather than in that order.

Step 3 — Enable TLS Inspection for the account

1. Go to Security > TLS Inspection.

2. Click the Enable TLS Inspection slider.

3. Click Save.

The default policy inspects all traffic except Cato's pre-configured bypass applications and the bypassed operating systems (Android, Linux, Unknown OS).

If this is a new account, click Start Review to run the TLS Inspection Configuration Wizard instead. It walks you through Cato's recommended Bypass and Inspect rules one at a time: review each rule, click Apply & Continue, then Apply & Complete Review, then Save. The wizard's bypass set covers the known certificate-pinning breakage and is a better starting point than a hand-built policy.

Step 4 — Scope inspection to a pilot group, then to GenAI

For a controlled rollout, invert the default: bypass everything, and inspect only your pilot.

1. On Security > TLS Inspection, click New.

2. Name: Bypass - All (rollout guard). Set Rule Order to the bottom of the policy.

3. Set Source to Any, Action to Bypass. Click Apply.

4. Click New again. Name: Inspect - GenAI pilot.

5. Set Rule Order above the bypass rule — higher priority sits closer to the top.

6. Expand Source and select your pilot: a Host, Network Interface, IP range, or a user group.

7. Under Criteria, narrow further if needed — Platforms, Countries, Device Posture Profiles, Connection Origin. Excluding unmanaged devices by posture profile is worth doing here.

8. Expand Destination and select the Generative AI Tools application category. Add the individual AI applications your users actually run — the App Catalog entries you identified before starting — if you want them named explicitly in the rule.

9. Leave TLS Version and Cipher Suites at the default unless you have a specific compliance floor to enforce.

10. Set Action to Inspect.

11. Set Untrusted Server Certificates handling. Allow is the default; Prompt or Block is stricter. Start at Allow during the pilot — switching straight to Block while certificate trust is still rolling out produces failures that look like inspection bugs.

12. Click Apply, then Save.

Widen the source on the Inspect rule as the pilot proves out, and remove the catch-all bypass rule when you are ready for full coverage.

Note: Cato maintains eight system categories for AI apps in addition to the general Generative AI Tools category. Check the exact category names in your own tenant's App Catalog before writing rules — code-assistant traffic in particular tends to sit in a separate category from chat-style tools, and a rule written only against Generative AI Tools may miss it.

Step 5 — Turn decrypted visibility into control

Inspection only gives you the view. The enforcement lives in two other policies, both of which now work because the traffic is decrypted.

Application Control (CASB) — Security > App & Data Inline

1. Create a rule with the AI application or the Generative AI Tools category in the Application section.

2. In Activities, select the specific behaviours to govern — upload, file share, login by authentication type, and similar. Leave Activities empty and the rule matches every activity for that app or category.

3. Set the Action: Allow, Block, or Notify.

A common first pair: allow chat on the sanctioned assistant, block file upload everywhere else. The same tenant-awareness approach used to separate corporate from personal GitHub activity applies here — allow login to the corporate AI tenant, block the personal one.

DLP — Generative AI Tools as the application, with content profiles for PII, Finance, Access Keys & Tokens, and Legal data. Accounts created after 25 March 2025 already have these as rules 15–18 in the default recommended CASB/DLP policy; older accounts create them manually. Start both in Monitor before moving to Block — you will find legitimate workflows you did not know about.

Step 6 — Fix developer and CLI breakage

AI coding assistants, SDK calls to model APIs, and package installs run through runtimes with their own certificate stores, which do not read the OS trust store. These fail with TLS errors the moment inspection starts. Point each at the Cato root CA:

bash

# Node.js (covers most IDE-based AI assistants)
export NODE_EXTRA_CA_CERTS=/path/to/CatoNetworksTrustedRootCA.pem

# npm
npm config set cafile "/path/to/cato_combined_ca.pem"

# Python requests
export REQUESTS_CA_BUNDLE=/path/to/cato_combined_ca.pem

# OpenSSL-based tools
export SSL_CERT_FILE=/path/to/cato_combined_ca.pem

# curl
export CURL_CA_BUNDLE=/path/to/cato_combined_ca.pem

# Git
git config --global http.sslCAInfo /path/to/cato_combined_ca.pem

# AWS CLI
export AWS_CA_BUNDLE=/path/to/cato_combined_ca.pem

For Java and Android Studio, import into the JDK keystore:

bash

keytool -importcert -noprompt -alias cato-root-ca \
  -file /path/to/CatoNetworksTrustedRootCA.pem \
  -keystore <path-to-keystore> -storepass changeit

On Windows, pip install pip-system-certs makes Python read the system store directly instead of setting the variable per shell.

Push these as environment variables through your MDM rather than asking each developer to set them by hand.

Verification

Confirm the session is being decrypted. On a pilot machine, open the AI tool in Chrome, click the padlock, open Certificate, and check Issued by. It should read Cato Networks followed by the PoP name. In Firefox, click the padlock, expand Connection, and check Verified by. If you still see the vendor's own CA, the traffic is being bypassed, not inspected.

Confirm Cato sees the activity. Open Security > GenAI Apps. The Overview section should now populate Top GenAI Users and Top User Activities Over Time; with a DLP license, the Data Protection section shows file uploads and violations by data profile. Activity-level data appearing here is the real proof that inspection is working — the certificate check only proves decryption on one machine.

Confirm coverage across the estate. Go to Home > Reports, open the Catalog tab, and generate the TLS Inspection report. It breaks out inspected versus bypassed traffic by OS, and lists top inspected and bypassed applications, domains and categories, plus TLS certificate error events. Any AI application showing high bypass counts is a gap in your policy.

Notes and common pitfalls

• Bypass removes threat scanning too. A bypass rule added to keep one tool working also takes that traffic out of anti-malware inspection. Scope bypasses to the narrowest possible destination.

• Android is not supported. Certificate pinning on Android means TLS Inspection does not apply. Control AI access on Android at the firewall or category level, or through MDM, not through inspection.

• Linux and Unknown OS are bypassed by default. If you have Linux developer machines using AI coding tools, they are outside inspection until you change the default bypass — and those are exactly the machines most likely to send code to a model.

• Split-tunnelled traffic is never inspected. If AI tool domains or applications are excluded from the tunnel in your split tunnel policy, that traffic goes direct to the internet and no TLS Inspection, CASB or DLP rule will ever see it. Check the split tunnel policy before you conclude an inspection rule is broken.

• Desktop AI clients differ from the browser. A vendor's native desktop app may pin certificates where the web version does not. If a tool works in Chrome and fails in its desktop client after enabling inspection, pinning is the likely cause.

• Navigation names moved in 2026. Current CMA builds use Security > App & Data Inline for Application Control. Older documentation and older tenants show Security > Security Configuration > App Control & Data Protection > Application Control (CASB). Both refer to the same policy.

• New AI tools appear constantly. Category-based rules age better than application-based rules. Review the App Catalog and the GenAI Apps dashboard monthly and mark newly sanctioned tools rather than rewriting rules each time.

FAQ

1) Can I inspect only GenAI traffic and leave everything else encrypted?

Yes. Create a Bypass rule with Source: Any at the bottom of the policy, and an Inspect rule above it whose Destination is the Generative AI Tools category. Traffic matching neither the AI category nor any higher-priority rule falls through to the bypass. This is the standard scoped-rollout pattern and also works as a permanent posture, though it means the rest of your traffic gets no payload-level threat scanning.

2) Why does my Application Control rule for ChatGPT show no activity data?

Almost always because that traffic is not being inspected. Application rules and category rules with a defined activity require TLS Inspection on the matching traffic. Check the TLS Inspection report for that application — if it appears under bypassed traffic, a higher-priority bypass rule or the default OS bypass is catching it first.

3) Does TLS inspection let me read the actual prompts users type?

Cato inspects the decrypted payload for policy and DLP matching, so content that trips a DLP content profile is detected and logged as a violation. This is pattern-based enforcement, not a transcript archive of every conversation. If your intent is a record of AI usage for audit, the GenAI Apps dashboard and DLP violation events are the source — and the privacy and employee-notification implications of inspecting this traffic are worth settling with HR and legal before you enable it, particularly under India's DPDP Act.

4) What about personal or unmanaged devices?

Inspection depends on the endpoint trusting the Cato root CA, which you cannot guarantee on an unmanaged device. Use Device Posture Profiles in the rule Criteria to separate managed from unmanaged, and control unmanaged AI access at the firewall or category level instead of trying to inspect it.