TLS inspection with Zenarmor: technology, GDPR and works councils

TLS inspection (also called SSL or HTTPS inspection) is lawful in the EU when you treat it as a security measure and design it carefully: a legitimate purpose, necessity and proportionality, employees informed in advance, a DPIA where monitoring is systematic, and, where national law requires it, the involvement of your works council. Technically, Zenarmor offers two levels: Light-weight (certificate-based), which identifies hostname, category and application without decrypting anything, and Full TLS Inspection (decrypt/re-encrypt), which actually opens and inspects the traffic. With more than 80 predefined bypassed domains (including banking and healthcare) and per-site inspection, you decide precisely what is and is not decrypted.

This article explains how both modes work, how to roll out the certificate, which Zenarmor plans include full inspection (status October 2026), and how to handle the GDPR and employee representation from day one, with short notes for the Netherlands and Germany. Secrotec writes this as an independent ISO 27001 Lead Auditor and official Zenarmor partner in the Netherlands: we configure TLS inspection so that it is secure and explainable to staff, to works councils and to auditors.

Why TLS inspection: threats hide in HTTPS

Almost all web traffic is now encrypted. That is good for privacy, but attackers benefit too: phishing pages run on valid certificates, malware is downloaded over HTTPS and command-and-control traffic blends into ordinary TLS sessions. According to Zscaler's ThreatLabz 2024 Encrypted Attacks Report, 87.2% of the threats Zscaler observed over a year were hidden in TLS/SSL-encrypted traffic. It is a vendor figure from its own cloud, but the trend is widely recognised.

Without inspection, your firewall mainly sees who talks to which server. It cannot see which file is downloaded, which path on a site is opened or what data leaves through a web form or cloud app. As a result:

• Malware and phishing on legitimate or newly registered domains slip through more easily.
• Web filtering works at domain level only, not on page content.
• Cloud rules, such as blocking uploads to a file-sharing service while allowing downloads, cannot be enforced without decryption.
• Data leakage through legitimate cloud storage stays largely invisible.

At the same time, decryption is intrusive: at the inspection point the traffic is briefly readable, including any personal data. The real question is therefore not whether to inspect, but how much and where.

Two modes in Zenarmor: light-weight or full inspection

Light-weight (certificate-based)

In light-weight mode Zenarmor decrypts nothing. The engine analyses the unencrypted parts of the TLS handshake, such as the server name (SNI) and the server certificate, to determine hostname, web category and application. That is enough for web filtering, application control and the security rules (blocking phishing, malware and botnet domains) to work on HTTPS traffic. According to Zenarmor's TLS inspection rules documentation, this mode is available in every edition, including the Free Edition. No client certificate is required, although without a trusted Zenarmor certificate you cannot show a clean block page for HTTPS sites.

Full TLS Inspection (decrypt/re-encrypt)

In full mode Zenarmor acts as a trusted intermediary. The client's TLS session is decrypted at the inspection point, inspected and then re-encrypted towards the destination. Clients must therefore trust the Zenarmor CA (or your own CA). Zenarmor can then also see the full URL, the content type and actions inside cloud apps. This enables content-based real-time anti-phishing and, depending on your plan, file scanning and CASB rules that block specific actions such as uploading or sharing. Our article on SSE, CASB and DLP shows how this closes a WeTransfer-style leak.

The policy also offers options such as "Exclude whitelisted/certificate-pinned websites from inspection", "Exclude flows without DNS enrichment data from inspection" and blocking TLS Encrypted Client Hello (ECH), which would otherwise hide the server name.

Aspect	Light-weight (certificate-based)	Full TLS Inspection (decrypt/re-encrypt)
Decryption	No	Yes, then re-encrypted
What Zenarmor sees	Hostname (SNI), certificate, category, application	Additionally full URL, content, files, cloud-app actions
CA certificate on clients	Not required (only for a clean block page)	Required
Privacy impact	Limited: metadata	High: content readable at the inspection point
Typical use	Web filter, app control, security categories	Malware and phishing in content, CASB actions, leakage prevention
Availability	All editions, including Free	Add-on for Unified Secure; included in Unified Secure Plus and SSE/ZTNA/SASE

Bypass list and per-site inspection

By default Zenarmor excludes more than 80 predefined domains from TLS inspection. According to the documentation on managing TLS inspection, this list is retrieved from the Zenarmor signature database. Zenarmor names healthcare destinations, banking and financial destinations, certificate-pinned apps (such as Adobe, Apple, Cisco Webex, Microsoft 365 and the Dropbox app) and undecryptable traffic as typical exclusions. On top of that you maintain your own bypass list.

Since Zenarmor 2.2 (November 2025) you can also enable full inspection per site: only the domains you list are decrypted, optionally uploaded in bulk via CSV. That reverses the logic from "everything except" to "only these". For many SMEs this is the most defensible starting point, for example inspecting only file-sharing services and other high-risk destinations while everything else stays light-weight.

Zenarmor's best practices point the same way: exclude financial, health and government categories, start with a small group of users, test lower-impact categories first, fully isolate BYOD and guest networks, and place IoT devices that cannot accept custom certificates in a separate subnet.

Rolling out the certificate: Zenarmor CA or your own CA

Full inspection only works if your devices trust the certificate Zenarmor uses to re-sign traffic. In Zenconsole you can generate or import a CA and download it in PEM or CRT format. If you already run a PKI, preferably use a dedicated subordinate CA for inspection and protect its private key; that is also an audit point under ISO 27001 A.8.24 (use of cryptography).

• Domain-joined Windows: a Group Policy under Computer Configuration › Policies › Windows Settings › Security Settings › Public Key Policies › Trusted Root Certification Authorities.
• Intune-managed devices: a trusted certificate profile in Microsoft Intune, one per platform (Windows, macOS, iOS/iPadOS, Android).
• macOS and iOS: a configuration profile from your MDM, such as Intune or Jamf.
• Firefox: uses its own certificate store; let Firefox import the Windows enterprise roots by policy, or install the certificate separately. Chrome and Edge use the operating system store.
• Android: many apps only trust system certificates by default, so expect additional bypass entries.

After rollout, check in Live Sessions that sessions show the "TLS-Inspected" status and that the browser certificate shows Zenarmor as issuer. If an app stops working, certificate pinning is almost always the cause: add the domain to the bypass list.

Performance: what does decryption cost?

Decrypting and re-encrypting consumes CPU and memory. Zenarmor's TLS inspection deployment guide focuses on planning and phased rollout, and the general hardware guidance (for example 0–50 devices around 300 Mbps with 1 GB RAM, 250–1,000 devices 1–2 Gbps with 16 GB RAM) gives no separate TLS figures. Plan generous headroom and measure during the pilot. Rules of thumb from our projects:

• Inspect selectively (per site or category) rather than everything.
• Block QUIC so browsers fall back to TCP/TLS; Zenarmor's TLS inspection depends on TCP session metadata.
• Choose hardware with AES acceleration and enough cores; Zenarmor 2.7 introduced multi-core processing for 10G environments on OPNsense.
• Monitor CPU load and latency after every extension of the inspection scope.

Which Zenarmor plans include TLS inspection?

Zenarmor introduced new plans on 30 September 2026. According to the official plans page (list prices in USD, status October 2026, excluding VAT, subject to change):

Plan	List price per user/month	Light-weight	Full TLS Inspection
Free	$0 (1 user/gateway)	Yes	No
Home	$9.99 per month, personal use only	Yes	No
Unified Secure	$5.00 (10–49) · $4.50 (50–99) · $4.00 (100–150)	Yes	Add-on: +$3.00 per user/month
Unified Secure Plus	$9.00 · $8.50 · $8.00	Yes	Included
SSE / ZTNA / SASE	On request	Yes	Included

Example calculation (list price): for 40 users, Unified Secure with the TLS add-on costs 40 × ($5.00 + $3.00) = $320 per month. Unified Secure Plus costs 40 × $9.00 = $360 per month. For $1 more per user you get 30 instead of 15 days of reporting retention, two agents per user, mesh VPN and site-to-site connectivity. Through Secrotec you also receive a partner discount, and the price is always negotiable in Zenarmor projects.

The legal framework: GDPR first

TLS inspection processes personal data: IP addresses, usernames, visited sites and, with full inspection, content. The GDPR does not prohibit it, but it requires careful justification. European data protection authorities even used TLS inspection as an explicit example in the Article 29 Working Party's Opinion 2/2017 on data processing at work (WP249).

Purpose and legal basis

The usual legal basis is legitimate interest (Article 6(1)(f) GDPR), supported by the obligation to implement appropriate security measures (Article 32). Document that the purpose is security, not the assessment of behaviour or performance. That purpose limitation will also be your strongest argument with employee representatives. Member states may adopt more specific rules for the employment context (Article 88).

Necessity, proportionality and subsidiarity

WP249 states that monitoring every online activity of employees is disproportionate and that less invasive means should be investigated first. Where some interception is strictly necessary, configure it to avoid permanent logging of employee activity, for example by blocking suspicious traffic and redirecting the user to an information page. Exclude traffic whose interception upsets the balance, such as private webmail, online banking and health websites, tell employees what is monitored, and ideally offer an unmonitored alternative such as guest Wi-Fi. In Zenarmor this translates into light-weight inspection as the baseline, full inspection per site or category, a generous bypass list and an isolated guest network.

DPIA and transparency

Systematic monitoring of employees, who are in a dependent position, frequently triggers a data protection impact assessment under Article 35. National authorities publish lists of processing that always requires one. Inform employees in advance, for instance in your acceptable use policy and staff privacy notice: what is inspected and why, which categories are excluded, how long data is kept and who has access.

Country note: the Netherlands

The Dutch Autoriteit Persoonsgegevens expects a DPIA before large-scale or systematic monitoring of employees, such as checking e-mail and internet use (AP: controle van werknemers). Under Article 27(1)(l) of the Dutch Works Councils Act (WOR), the works council must consent to arrangements for facilities that are aimed at or suitable for monitoring employees' attendance, behaviour or performance. A firewall with TLS inspection and per-user reporting qualifies. Without consent the works council can invoke nullity within one month, unless the subject is already covered by a collective labour agreement.

Country note: Germany

Under Section 87(1) no. 6 of the Works Constitution Act (BetrVG), the Betriebsrat has a co-determination right on the introduction and use of technical systems designed to monitor employee behaviour or performance. The Federal Labour Court has long held that objective suitability for monitoring is enough. In practice, TLS inspection is introduced through a works agreement (Betriebsvereinbarung) covering purpose, exclusions, retention and access. If private internet use is permitted, also check telecommunications secrecy, which is a disputed point in German law.

Requirement	What you document	How Zenarmor supports it
Purpose limitation	Security only, no performance assessment	Policies focused on security categories and high-risk destinations
Data minimisation	Light-weight where possible, full where needed	Light-weight baseline, full inspection per site or category
Sensitive destinations	Exclude banking, health, government, private webmail	80+ predefined exclusions plus your own bypass list
Retention	Justified period per log type	Reporting database retention setting and SIEM streaming
Access	Who may view logs and when	Zenconsole roles and audit trail of admin actions
Alternative	Unmonitored private use	Isolated guest network without inspection

Please note: this article is not legal advice. It reflects the main points as of October 2026; have your specific situation reviewed by your data protection officer or an employment and privacy lawyer.

Mapping to ISO 27001, TISAX and NIS2

TLS inspection is not a goal in itself but a technical way to meet requirements from several frameworks. Zenarmor supports those requirements; compliance comes from the combination of policy, risk assessment and demonstrable operation.

Framework	Control	Contribution of TLS inspection
ISO 27001:2022	A.8.7 Protection against malware	Detecting malware and phishing, including in encrypted traffic
ISO 27001:2022	A.8.20 Networks security	Visibility and control over network traffic
ISO 27001:2022	A.8.23 Web filtering	Categories and policies also apply to HTTPS
ISO 27001:2022	A.8.24 Use of cryptography	Managing and protecting the inspection CA
TISAX (VDA ISA 6)	5.2.3 Malware protection	Inspection at network gateways, including encrypted connections
NIS2 Art. 21	Risk-management measures (network security, cryptography)	Demonstrable, risk-based control of encrypted traffic

TISAX numbering follows VDA ISA 6 and may shift in ISA2027. Read more in our article on TISAX readiness and network security and on our NIS2 compliance page.

Step-by-step: introducing TLS inspection smoothly

How Secrotec helps

Secrotec is an independent ISO 27001 Lead Auditor and official Zenarmor partner in the Netherlands, delivering Zenarmor licences and projects throughout the EU. That combines two perspectives that meet in TLS inspection: the technical configuration, and whether it survives an audit, a DPIA review and a works council discussion.

• We provide the technical input for your DPIA and a clear description for the works council.
• We configure Zenarmor with light-weight inspection as the baseline, full inspection where risk justifies it, and a reasoned bypass list.
• We map the settings to ISO 27001 Annex A, NIS2 Article 21 and VDA ISA, so the evidence is ready for your auditor.
• You buy the licences through us with a partner discount; the price is always negotiable in Zenarmor projects.

See our Zenarmor partner page, learn how to use Zenarmor reporting as audit evidence, or return to the Firewall & Networks overview.