WarmTransfer
network foundations · published

Web proxies and TLS inspection that break UC clients

Verified 2026-10-14 · 57 sources · tier 1–2

Also known as ssl-inspection-uc-clients.

Microsoft recommends bypassing TLS decryption, traffic interception, and deep packet inspection for all Required Microsoft 365 endpoints 11. Cisco requires Webex Meetings media hosts to be exempted from TLS inspection, and Zoom recommends avoiding SSL/TLS inspection of Zoom traffic 11 40 52. Apple states that Apple services fail any connection that uses HTTPS interception 2. CISA states that a client behind an HTTPS interception product can verify only its connection to that product, not its connection to the real server 2 6.

How it breaks

WarmTransfer's reading of the sources is that proxy and TLS-inspection failures in cloud UC split into 2 layers 26:

  • Sign-in and signaling: we infer that HTTPS sign-in and signaling go through the proxy and break when the inspection CA is untrusted, when the proxy requires authentication, or when the proxy changes headers 26.
  • Media: we infer that media normally bypasses the proxy over UDP but is pushed back through the proxy when UDP and TCP are blocked 26.

In Webex Calling, only HTTP and HTTPS signaling goes to the proxy 49. Client SIP registration and the associated SRTP-over-UDP media are not sent to the proxy and flow directly to the firewall 49. Webex apps and Cisco Video devices prefer media transports in the order UDP, TCP, then TLS, and fall back to TLS if TCP ports are blocked 39. Cisco strongly recommends against using TLS to transport Webex media in production, because TLS media through a configured proxy is routed via the proxy and can create bottlenecks 44.

Certificate trust

For a TLS-inspecting proxy in front of Webex, the certificate the proxy presents must be signed by a CA whose root is in the trust store of the Webex App or Webex device 42. For the Webex App, that CA is installed in the device operating system 42.

CISA reports that many HTTPS interception products do not properly verify the server's certificate chain before re-encrypting traffic 5. CISA also reports that these products seldom forward chain-verification errors to the client 5. CISA warns that an inspection product may negotiate deprecated protocol versions or weak ciphers with the upstream server while the user sees a strongly encrypted connection to the proxy 7.

Protocol handling

The Webex App does not send the SNI extension on TLS-based media connections 41. A proxy that requires SNI therefore causes connection failures to Webex audio and video services 41.

Microsoft lists several network behaviors as known to cause Microsoft 365 connectivity issues 18 9:

  • Forcing protocol downgrade or failover between client apps and Microsoft 365, such as UDP to TCP or TLS 1.3 to TLS 1.2 18.
  • Blocking specific protocols or protocol versions on intermediate infrastructure, with QUIC and WebSockets as examples 9.

Teams uses long-lived WebSocket connections for chat updates, call notifications and signaling, and presence 35. If WebSockets can't be established, Teams falls back to HTTP long polling, which increases bandwidth and latency 35. Cisco says that if an inspecting proxy interferes with Webex Calling WebSocket connections, bypassing inspection for *.webex.com may resolve the problem 50.

Proxy authentication and header changes

Microsoft lists routing Microsoft 365 connections through infrastructure that applies its own authentication, such as proxy authentication, as known to cause connectivity issues 19. Cisco strongly recommends not altering or deleting HTTP header values as Webex signaling passes through a proxy or firewall, except where W3C guidelines permit 38.

Latency and quality

Microsoft states that, among proxy and perimeter functions, TLS Break and Inspect creates the largest latency 10. Microsoft adds that proxy authentication and reputation lookup can also degrade performance 10. Microsoft states that Teams media traffic is already encrypted, so passing it through a proxy does not make it more secure, and that proxies can add latency and packet loss 32. Zoom states that inspection on proxy servers or next-generation firewalls can add significant delay and degrade Zoom audio, video, and signaling 52.

See also Choppy and robotic audio on calls.

Fixed-function devices

Microsoft states that installing privately signed certificates, such as an SSL-inspection proxy CA, on Teams phones and other Android-based Teams devices isn't supported 28. Android-based Teams devices, including phones, panels, displays, and boards, don't support authenticated proxy servers or tenant restrictions, and Microsoft recommends they bypass proxy infrastructure 27.

Windows-based devices are handled differently 33 36:

  • If the proxy uses a privately signed certificate for SSL inspection, Microsoft states that the certificate and its chain must be installed on the Teams meeting room device so the device trusts it 33.
  • Windows-based Teams meeting rooms and Surface Hubs support some proxy servers but don't support proxy servers that require authentication 36.

Cisco devices need a TAC service request to trust an inspection CA 43 47:

  • To have Cisco Video devices trust a TLS-inspecting proxy, the customer opens a TAC service request to install the proxy's CA certificate into RoomOS 43.
  • For Webex Calling behind a TLS-inspecting proxy, Cisco multiplatform (MPP) IP phones also need a TAC service request to install the proxy's CA certificate 47.

We infer that, for fixed-function UC devices, exempting UC traffic from inspection is more practical than distributing the inspection CA 24. We infer this because Microsoft does not support private CAs on Android-based Teams phones, and Cisco devices need a TAC case to add one 24.

Platform differences

Microsoft 365 and Teams

Microsoft recommends that Teams traffic bypass proxy server infrastructure, including SSL inspection 29. Microsoft also suggests placing Teams Phones and Teams Rooms devices on a dedicated VLAN with direct internet access 29.

Microsoft states that it has not tested TLS termination or deep packet inspection of any Microsoft 365 domain by customer proxies or other network devices, and that these are known to cause connectivity issues 22.

Microsoft states that TLS break and inspect and proxy authentication are incompatible with both the Optimize and Allow categories of Microsoft 365 endpoints 16. For that reason, Allow endpoints sent to a proxy must be listed there to bypass further processing 16. Microsoft does not support selective allow-listing of only the endpoints thought to serve particular scenarios, and says to apply its guidance to the full set of published required endpoints 15.

Where Teams traffic must traverse a proxy, Microsoft recommends direct UDP-based routing for media rather than TCP, and allowing UDP 3478-3481 for Teams media through the firewall 34.

Attendees of Teams events optimized for large audiences and of view-only meetings receive the stream over TCP HTTPS 31. For the commercial cloud, Microsoft recommends bypassing proxies and disabling SSL inspection for these domains 31:

  • *.ml.cdn.office.net 31
  • *.ml.teams.microsoft.com 31
  • *.ml.communications.svc.cloud.microsoft 31
  • *.ml.communications.svc.static.microsoft 31

Microsoft's support position covers decrypting and inspecting network solutions as follows 20 14:

  • Customers must disclose decrypting or inspecting network solutions when opening Microsoft 365 support requests, and must disable decryption of the affected traffic or bypass the solution while troubleshooting 20.
  • Using third-party features to change, scrub, or block decrypted Microsoft 365 traffic alters its protocols outside documented APIs, isn't supported, and may violate the terms of service 14.

Webex and Webex Calling

Customers who inspect webex.com traffic must exempt these hosts from TLS inspection, because the Webex App does not support proxy decryption and inspection of TLS sessions for Webex Meetings media services 40:

  • mcs.webex.com 40
  • cb.webex.com 40
  • mcc.webex.com 40

Webex Hybrid Services Directory, Calendar, and Management Connectors do not support custom trusted CAs for TLS inspection 37. Cisco Video devices, Video Mesh, and Hybrid Data Security do support them 37.

Webex Calling documentation lists these supported proxy types: explicit proxies (inspecting or non-inspecting), transparent non-inspecting proxies, and transparent inspecting proxies 48.

On Windows:

  • Webex App for Windows supports No Auth, Basic, and NTLM proxy authentication, with NTLM only when the machine is logged on to the domain 45.
  • Cisco advises using WinINet rather than WinHTTP for proxy configuration settings, and describes WinINet as a superset of WinHTTP 46.

Zoom

Zoom recommends using SRTP and avoiding SSL/TLS inspection of Zoom traffic 52. Zoom does not recommend routing Zoom media through proxy infrastructure or applying deep packet inspection to it, and warns that web proxies that are not video-aware can cause poor call quality 55. Zoom states that UDP gives the best experience for Zoom media and that TCP is supported for proxy traversal only, with overhead that can hurt audio and video quality 57.

Zoom's firewall and proxy settings article recommends allowing zoom.us and *.zoom.us through proxy or SSL inspection, and notes that HTTPS/SSL proxies on port 443 are supported for Zoom traffic 51. That article's proxy server guidance states that it does not apply to the Zoom Phone service 56.

Zoom says custom header insertion on next-generation firewalls usually requires SSL decryption of TCP 443 traffic 54. Zoom supports this only for Zoom apps enrolled in MDM with certificate pinning disabled 54. The Zoom client requires firewall access over HTTP port 80 to certificate-validation URLs for CAs including DigiCert, GoDaddy, Sectigo, and Entrust 53.

RingCentral

RingCentral's network requirements say enterprises should use RingCentral's advertised IP supernets to selectively disable Layer 7 device functions, such as deep packet inspection, for UDP traffic to and from its cloud 25.

See also Firewall ports and IP ranges for cloud calling.

Apple push services

Apple states that HTTPS interception must be disabled on web proxies for the hosts it lists 2. Apple says its services can be used through a proxy if packet inspection and authentication are disabled for traffic to and from the listed hosts 3.

WarmTransfer's reading of the sources is that an iOS softphone that relies on APNs for incoming-call alerts is likely to miss calls on a network that inspects *.push.apple.com, even when its own UC service is exempted 8.

Diagnosing it

Microsoft's Teams network guidance lists calls that keep dropping as a symptom that might be due to firewall or proxy blockers 30. For Webex audio and video connection failures, check whether the proxy requires SNI, because the Webex App does not send it on TLS-based media connections 41.

For Microsoft 365 support cases, disable decryption of the affected traffic or bypass the inspecting solution while troubleshooting, as Microsoft's support position requires 20.

CISA recommends these checks before deploying HTTPS inspection 4:

  • Verify that the inspection product validates certificate chains and passes errors to clients, for example by testing with badssl.com 4.
  • Weigh the risks of HTTPS inspection before deploying it 4.

Implementing bypass

Microsoft 365 admins can deliver PAC scripts through WPAD or GPO so that Microsoft 365 requests bypass the proxy and use direct internet connections 17. The Get-PacFile PowerShell script generates 2 PAC file types 13:

  • Type 1 sends Optimize endpoint traffic direct and everything else to the proxy 13.
  • Type 2 sends both Optimize and Allow endpoint traffic direct 13.

Microsoft's guidance on keeping bypass lists current covers its publishing cadence and change notification 12 23:

  • Microsoft usually publishes changes to Microsoft 365 IP addresses and URLs near the last day of each month, and aims for 30 days notice before a service goes live on an added endpoint 12.
  • Microsoft recommends calling the /version method of the Microsoft 365 IP Address and URL Web Service once an hour, and fetching /endpoints or /changes only when the version changes 23.

Applicability

Applies to: Microsoft 365, Microsoft Teams, Microsoft Teams Rooms, Cisco Webex App, Cisco RoomOS, Cisco Webex Hybrid Services, Cisco Webex Calling, Cisco MPP IP Phones, Apple Push Notification service, CISA, Zoom Workplace, Zoom Phone, and RingCentral RingEX. Deployments: hybrid and multi-tenant. Sources checked 2026-10-14. As of 2026-10-14, Microsoft's support-position article on third-party network devices with Microsoft 365 is served from the Microsoft Learn previous-versions archive and is flagged as archived 21. Webex Hybrid Services Directory, Calendar, and Management Connectors are a hybrid case that does not support custom trusted CAs for TLS inspection 37.

What remains uncertain

Microsoft's support-position article on third-party network devices is archived 21. Whether a current replacement restates that position is not covered by the sources below.

Zoom's proxy guidance in its firewall and proxy settings article states that it does not apply to the Zoom Phone service 56. Proxy or TLS-inspection guidance specific to Zoom Phone is not covered by the sources below.

The full list of Apple hosts that must be exempted from HTTPS interception is not covered by the sources below. Measured latency figures for TLS inspection of UC traffic are not covered by the sources below.

This is inferred rather than stated by a vendor for the following points, so readers should verify them against their own environment 26 24 8:

  • WarmTransfer's reading of the sources is that failures split into a signaling layer and a media layer 26.
  • We infer that exempting traffic is more practical than distributing the inspection CA for fixed-function devices 24.
  • This is inferred: inspecting *.push.apple.com is likely to cause missed calls on iOS softphones 8.

See also

Related to

Sources

  1. 1
    Apple's enterprise network article lists *.push.apple.com for push notifications in its Device management table, with TCP ports that include 443, 5223 and 2197.
    Use Apple products on enterprise networks · Device management table, *.push.apple.com row · Checked 2026-10-14
  2. 2
    Apple states that Apple services will fail any connection that uses HTTPS interception (SSL inspection), and that HTTPS interception must be disabled on web proxies for the hosts it lists.
    Use Apple products on enterprise networks · Introductory section before 'Apple Push Notifications' · Checked 2026-10-14
  3. 3
    Apple says its services can be used through a proxy if packet inspection and authentication are disabled for traffic to and from the listed hosts.
    Use Apple products on enterprise networks · HTTP proxy section · Checked 2026-10-14
  4. 4
    CISA recommends verifying that an HTTPS inspection product validates certificate chains and passes errors to clients, for example by testing with badssl.com, and weighing the risks before deploying HTTPS inspection.
    HTTPS Interception Weakens TLS Security (TA17-075A) · Solution section · Checked 2026-10-14
  5. 5
    CISA reports that many HTTPS interception products do not properly verify the server's certificate chain before re-encrypting traffic, and seldom forward chain-verification errors to the client.
    HTTPS Interception Weakens TLS Security (TA17-075A) · Description section · Checked 2026-10-14
  6. 6
    CISA states that behind an HTTPS interception product, the client can only verify the connection between itself and the interception product, not the connection to the real server.
    HTTPS Interception Weakens TLS Security (TA17-075A) · Description section · Checked 2026-10-14
  7. 7
    CISA warns that an HTTPS inspection product may negotiate deprecated protocol versions or weak ciphers with the upstream server while the user sees a strongly encrypted connection to the proxy.
    HTTPS Interception Weakens TLS Security (TA17-075A) · Description section · Checked 2026-10-14
  8. 8
    Because Apple fails connections that use HTTPS interception, an iOS softphone that relies on APNs for incoming-call alerts is likely to miss calls on a network that inspects *.push.apple.com, even when its own UC service is exempted.inferred
    Use Apple products on enterprise networks · Introductory section (HTTPS Interception statement) combined with Device management table · Checked 2026-10-14
  9. 9
    Microsoft lists blocking specific protocols or protocol versions on intermediate network infrastructure, with QUIC and WebSockets as examples, as known to cause Microsoft 365 connectivity issues.
    Microsoft 365 network connectivity principles · Additional network considerations, bullet 2 · Checked 2026-10-14
  10. 10
    Microsoft states that among proxy and perimeter functions, TLS Break and Inspect creates the largest latency, and that proxy authentication and reputation lookup can also degrade performance.
    Managing Microsoft 365 endpoints · Use a PAC file for direct routing of vital Microsoft 365 traffic, paragraph 1 · Checked 2026-10-14
  11. 11
    For all Required Microsoft 365 network endpoints, Microsoft recommends bypassing TLS decryption, traffic interception, deep packet inspection and network packet and content filtering.
    Microsoft 365 network connectivity principles · Optimizing connectivity to Microsoft 365 services > recommended network configurations for all Required endpoints (first sub-bullet) · Checked 2026-10-14
  12. 12
    Microsoft usually publishes changes to Microsoft 365 IP addresses and URLs near the last day of each month, and aims for 30 days notice before a service goes live on an added endpoint.
    Managing Microsoft 365 endpoints · Change management for Microsoft 365 IP addresses and URLs, paragraphs 2-3 · Checked 2026-10-14
  13. 13
    The Get-PacFile PowerShell script generates two PAC file types: type 1 sends Optimize endpoint traffic direct and everything else to the proxy, and type 2 sends both Optimize and Allow endpoint traffic direct.
    Managing Microsoft 365 endpoints · Use a PAC file for direct routing of vital Microsoft 365 traffic, PAC type table · Checked 2026-10-14
  14. 14
    Microsoft states that using third-party features to change, scrub or block decrypted Microsoft 365 traffic alters its protocols outside documented APIs, isn't supported, and may violate the terms of service.
    Use third-party network devices or solutions with Microsoft 365 · More Information, bullet 4 · Checked 2026-10-14
  15. 15
    Microsoft does not support selective allow-listing of only the Microsoft 365 endpoints thought to serve particular scenarios, and says to apply its guidance to the full set of published required endpoints.
    Microsoft 365 network connectivity principles · Optimizing connectivity to Microsoft 365 services, opening paragraph · Checked 2026-10-14
  16. 16
    Microsoft states that TLS break and inspect and proxy authentication are incompatible with both the Optimize and Allow categories of Microsoft 365 endpoints, so Allow endpoints sent to a proxy must be listed there to bypass further processing.
    Managing Microsoft 365 endpoints · Use a PAC file for direct routing of vital Microsoft 365 traffic, paragraph beginning 'Separately if you choose to only do direct routing'; also Proxy server bypass processing of Microsoft 365 network traffic · Checked 2026-10-14
  17. 17
    Microsoft 365 admins can deliver PAC scripts through WPAD or GPO so that Microsoft 365 requests bypass the proxy and use direct internet connections.
    Microsoft 365 network connectivity principles · Assess bypassing proxies, traffic inspection devices, and duplicate security technologies > PAC (Proxy Automatic Configuration) scripts · Checked 2026-10-14
  18. 18
    Microsoft lists forcing protocol downgrade or failover between client apps and Microsoft 365, such as UDP to TCP or TLS 1.3 to TLS 1.2, as a network scenario known to cause connectivity issues.
    Microsoft 365 network connectivity principles · Additional network considerations, bullet 3 · Checked 2026-10-14
  19. 19
    Microsoft lists routing Microsoft 365 connections through network infrastructure that applies its own authentication, such as proxy authentication, as known to cause connectivity issues.
    Microsoft 365 network connectivity principles · Additional network considerations, bullet 4 · Checked 2026-10-14
  20. 20
    Microsoft's support position requires customers to disclose decrypting or inspecting network solutions when opening Microsoft 365 support requests, and to disable decryption of the affected traffic or bypass the solution while troubleshooting.
    Use third-party network devices or solutions with Microsoft 365 · More Information, bullet beginning 'Microsoft requires users to disclose' · Checked 2026-10-14
  21. 21
    As of 2026-10-14, Microsoft's support-position article on third-party network devices with Microsoft 365 is served from the Microsoft Learn previous-versions archive and flagged as archived.
    Use third-party network devices or solutions with Microsoft 365 · page front matter: canonicalUrl under /previous-versions/, is_archived true · Checked 2026-10-14
  22. 22
    Microsoft states that it has not tested TLS termination or deep packet inspection of any Microsoft 365 domain by customer proxies or other network devices, and that these are known to cause connectivity issues.
    Microsoft 365 network connectivity principles · Additional network considerations, bullet 1 · Checked 2026-10-14
  23. 23
    Microsoft recommends calling the /version method of the Microsoft 365 IP Address and URL Web Service once an hour, and fetching /endpoints or /changes only when the version changes.
    Managing Microsoft 365 endpoints · Change management > Change notification using the Web Service · Checked 2026-10-14
  24. 24
    For fixed-function UC devices, exempting UC traffic from inspection is the practical path rather than distributing the inspection CA: Microsoft does not support private CAs on Android-based Teams phones, and Cisco devices need a TAC case to add one.inferred
    Proxy servers for Teams · If you need to use a proxy server > Note; compare Webex Network Requirements > Proxy Inspection and Certificate Pinning · Checked 2026-10-14
  25. 25
    RingCentral's network requirements say enterprises should use RingCentral's advertised IP supernets to selectively disable Layer 7 device functions, such as deep packet inspection, for UDP traffic to and from its cloud.
    Network Requirements | MVP · Section 2, IP supernets · Checked 2026-10-14
  26. 26
    Proxy and TLS-inspection failures in cloud UC split into two layers: HTTPS sign-in and signaling, which goes through the proxy and breaks on untrusted inspection CAs, proxy authentication or header changes; and media, which normally bypasses the proxy over UDP but is pushed back through it when UDP and TCP are blocked.inferred
    Port Reference Information for Webex Calling · Proxy support section, read together with Webex Network Requirements 'Transport protocols and encryption ciphers' · Checked 2026-10-14
  27. 27
    Android-based Teams devices, including Teams phones, panels, displays and boards, don't support authenticated proxy servers or tenant restrictions, and Microsoft recommends they bypass proxy infrastructure.
    Proxy servers for Teams · Android-based Teams devices · Checked 2026-10-14
  28. 28
    Microsoft states that installing privately signed certificates, such as an SSL-inspection proxy CA, on Teams phones and other Android-based Teams devices isn't supported.
    Proxy servers for Teams · If you need to use a proxy server > Note · Checked 2026-10-14
  29. 29
    Microsoft recommends that Teams traffic bypass proxy server infrastructure, including SSL inspection, and suggests placing Teams Phones and Teams Rooms devices on a dedicated VLAN with direct internet access.
    Proxy servers for Teams · Not using a proxy server is recommended, final paragraph · Checked 2026-10-14
  30. 30
    Microsoft's Teams network guidance lists calls that keep dropping as a symptom that might be due to firewall or proxy blockers.
    Prepare your organization's network for Microsoft Teams · Network optimization, bullet list 'You might want to do other network optimization if' · Checked 2026-10-14
  31. 31
    Attendees of Teams events optimized for large audiences and of view-only meetings receive the stream over TCP HTTPS, and Microsoft recommends bypassing proxies and disabling SSL inspection for *.ml.cdn.office.net, *.ml.teams.microsoft.com, *.ml.communications.svc.cloud.microsoft and *.ml.communications.svc.static.microsoft in the commercial cloud.
    Proxy servers for Teams · Recommendation for Teams events optimized for large audiences and Teams view-only meetings > Commercial cloud · Checked 2026-10-14
  32. 32
    Microsoft states that Teams media traffic is already encrypted, so passing it through a proxy server does not make it more secure, and proxies can add latency and packet loss.
    Proxy servers for Teams · Not using a proxy server is recommended, paragraphs 1-2 · Checked 2026-10-14
  33. 33
    Microsoft states that if the proxy uses a privately signed certificate for SSL inspection, the certificate and its chain must be installed on the Teams meeting room device so the device trusts it.
    Proxy servers for Teams · If you need to use a proxy server > Note, sentence 1 · Checked 2026-10-14
  34. 34
    Where Teams traffic must traverse a proxy, Microsoft recommends direct UDP-based routing for media rather than TCP, and allowing UDP 3478-3481 for Teams media through the firewall.
    Proxy servers for Teams · If you need to use a proxy server > Microsoft also strongly recommends, bullets 3-4 · Checked 2026-10-14
  35. 35
    Teams uses long-lived WebSocket connections for chat updates, call notifications and signaling, and presence; if WebSockets can't be established it falls back to HTTP long polling, which increases bandwidth and latency.
    Prepare your organization's network for Microsoft Teams · Network optimization table > Allow WebSocket protocol · Checked 2026-10-14
  36. 36
    Windows-based Teams meeting rooms and Surface Hubs support some proxy servers but don't support proxy servers that require authentication.
    Proxy servers for Teams · Windows-based Teams devices · Checked 2026-10-14
  37. 37
    Webex Hybrid Services Directory, Calendar and Management Connectors do not support custom trusted CAs for TLS inspection, whereas Cisco Video devices, Video Mesh and Hybrid Data Security do.
    Network Requirements for Webex Services · Proxy Features > Proxy Inspection and Certificate Pinning > TLS inspection support table · Checked 2026-10-14
  38. 38
    Cisco strongly recommends not altering or deleting HTTP header values as Webex signaling passes through a proxy or firewall, except where W3C guidelines permit.
    Network Requirements for Webex Services · Webex signaling traffic and Enterprise Proxy Configuration · Checked 2026-10-14
  39. 39
    Webex apps and Cisco Video devices prefer media transports in the order UDP, TCP, then TLS, and fall back to TLS if TCP ports are blocked.
    Network Requirements for Webex Services · Transport protocols and encryption ciphers · Checked 2026-10-14
  40. 40
    The Webex App does not support proxy decryption and inspection of TLS sessions for Webex Meetings media services; customers who inspect webex.com traffic must exempt *mcs*.webex.com, *cb*.webex.com and *mcc*.webex.com from TLS inspection.
    Network Requirements for Webex Services · Proxy Features > Proxy Inspection and Certificate Pinning > Note below the TLS inspection support table · Checked 2026-10-14
  41. 41
    The Webex App does not send the SNI extension on TLS-based media connections, so a proxy that requires SNI will cause connection failures to Webex audio and video services.
    Network Requirements for Webex Services · Proxy Features > Proxy Inspection and Certificate Pinning (SNI sentence) · Checked 2026-10-14
  42. 42
    For a TLS-inspecting proxy in front of Webex, the certificate the proxy presents must be signed by a CA whose root is in the Webex App's or Webex device's trust store; for the Webex App, that CA is installed in the device operating system.
    Network Requirements for Webex Services · Proxy Features > Proxy Inspection and Certificate Pinning, paragraphs 1-2 · Checked 2026-10-14
  43. 43
    To have Cisco Video devices trust a TLS-inspecting proxy, the customer opens a TAC service request to install the proxy's CA certificate into RoomOS.
    Network Requirements for Webex Services · Proxy Features > Proxy Inspection and Certificate Pinning, paragraph 3 · Checked 2026-10-14
  44. 44
    Cisco strongly recommends against using TLS to transport Webex media in production, because TLS media through a configured proxy is routed via the proxy and can create bottlenecks.
    Network Requirements for Webex Services · Transport protocols and encryption ciphers > Disadvantages of using TLS as a media transport protocol · Checked 2026-10-14
  45. 45
    Webex App for Windows supports No Auth, Basic and NTLM proxy authentication, with NTLM only when the machine is logged on to the domain.
    Network Requirements for Webex Services · Proxy Features > Proxy Authentication Support table, Webex for Windows row · Checked 2026-10-14
  46. 46
    For Webex on Windows, Cisco advises using WinINet rather than WinHTTP for proxy configuration settings, describing WinINet as a superset of WinHTTP.
    Network Requirements for Webex Services · Proxy Features > Guidance on Proxy settings for Windows OS · Checked 2026-10-14
  47. 47
    For Webex Calling behind a TLS-inspecting proxy, Cisco multiplatform (MPP) IP phones, like Webex Room devices, need a TAC service request to install the proxy's CA certificate.
    Port Reference Information for Webex Calling · Proxy support > TLS inspection / certificate trust subsection · Checked 2026-10-14
  48. 48
    Webex Calling documentation lists explicit proxies (inspecting or non-inspecting), transparent non-inspecting proxies and transparent inspecting proxies as supported proxy types.
    Port Reference Information for Webex Calling · Proxy support section, supported proxy types · Checked 2026-10-14
  49. 49
    In Webex Calling, only HTTP and HTTPS signaling goes to the proxy; SIP registration by clients and the associated SRTP-over-UDP media are not sent to the proxy and flow directly to the firewall.
    Port Reference Information for Webex Calling · Proxy support section · Checked 2026-10-14
  50. 50
    Cisco says that if an inspecting proxy interferes with Webex Calling WebSocket connections, bypassing inspection for *.webex.com may resolve the problem.
    Port Reference Information for Webex Calling · Proxy support section, WebSocket note · Checked 2026-10-14
  51. 51
    Zoom's firewall and proxy settings article recommends allowing zoom.us and *.zoom.us through proxy or SSL inspection, and notes that HTTPS/SSL proxies on port 443 are supported for Zoom traffic.
    Zoom network firewall or proxy server settings · Proxy server section · Checked 2026-10-14
  52. 52
    Zoom recommends using SRTP and avoiding SSL/TLS inspection of Zoom traffic, saying that inspection on proxy servers or next-generation firewalls can add significant delay and degrade Zoom audio, video and signaling.
    Configuring Network Components for Zoom · Packet Inspection > Use Secure Real Time Protocol (SRTP) and avoid SSL/TLS inspection for Zoom traffic · Checked 2026-10-14
  53. 53
    The Zoom client requires firewall access over HTTP port 80 to certificate-validation URLs for CAs including DigiCert, GoDaddy, Sectigo and Entrust.
    Zoom network firewall or proxy server settings · Firewall rules for certificate validation · Checked 2026-10-14
  54. 54
    Zoom says custom header insertion on next-generation firewalls usually requires SSL decryption of TCP 443 traffic, and is supported only for Zoom apps enrolled in MDM with certificate pinning disabled.
    Configuring Network Components for Zoom · Firewall > Custom header insertions on next-generation firewalls (Note callout) · Checked 2026-10-14
  55. 55
    Zoom does not recommend routing Zoom media through proxy infrastructure or applying deep packet inspection to Zoom media, warning that web proxies that are not video-aware can cause poor call quality.
    Configuring Network Components for Zoom · Firewall > Proper external firewall and external router configuration (Caution callout) · Checked 2026-10-14
  56. 56
    Zoom's proxy server guidance in its firewall and proxy settings article states that it does not apply to the Zoom Phone service.
    Zoom network firewall or proxy server settings · Proxy server section · Checked 2026-10-14
  57. 57
    Zoom states that UDP gives the best experience for Zoom media and that TCP is supported for proxy traversal only, with overhead that can hurt audio and video quality.
    Configuring Network Components for Zoom · Firewall section, Caution callout on UDP and TCP · Checked 2026-10-14

Documents

tier 1 standards and regulators

HTTPS Interception Weakens TLS Security (TA17-075A)

CISA (US-CERT) · 2017-03-16 · accessed 2026-10-14

tier 2 current vendor documentation

Configuring Network Components for Zoom

Zoom · accessed 2026-10-14

tier 2 current vendor documentation

Managing Microsoft 365 endpoints

Microsoft · 2026-06-26 · accessed 2026-10-14

tier 2 current vendor documentation

Microsoft 365 network connectivity principles

Microsoft · 2026-08-26 · accessed 2026-09-24

tier 2 current vendor documentation

Network Requirements | MVP

RingCentral · accessed 2026-09-24

tier 2 current vendor documentation

Network Requirements for Webex Services

Cisco Systems, Inc. (help.webex.com) · 2026-09-09 · accessed 2026-09-16

tier 2 current vendor documentation

Port Reference Information for Webex Calling

Cisco Systems, Inc. (help.webex.com) · 2026-09-08 · accessed 2026-09-16

tier 2 current vendor documentation

Prepare your organization's network for Microsoft Teams

Microsoft (Microsoft Learn) · 2026-07-09 · accessed 2026-09-06

tier 2 current vendor documentation

Proxy servers for Teams

Microsoft · 2026-05-25 · accessed 2026-10-14

tier 2 current vendor documentation

Use Apple products on enterprise networks

Apple · 2026-08-07 · accessed 2026-10-14

tier 2 current vendor documentation

Use third-party network devices or solutions with Microsoft 365

Microsoft · 2025-05-29 · accessed 2026-10-14

tier 2 current vendor documentation

Zoom network firewall or proxy server settings

Zoom Communications · accessed 2026-09-25

Cite this page

APA

WarmTransfer. (2026, October 14). Web proxies and TLS inspection that break UC clients. WarmTransfer. https://warmtransfer.net/knowledge/tls-inspection-uc-clients

BibTeX

@misc{warmtransfer-tls-inspection-uc-clients,
  title  = {Web proxies and TLS inspection that break UC clients},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/tls-inspection-uc-clients},
  note   = {Verified 2026-10-14}
}