This document describes the structured methodology for diagnosing website access issues when routed through a Cloud-Based Proxy (Secure Web Gateway/SWG), but not when using Direct Internet Access (DIA).
Common proxy interference indicators include:
s_proxy (Nginx proxy) or m_proxy (Modular Proxy Service/MPS) confirms traffic is proxied.openssl s_client -connect www.example.com:443 -showcerts curl with and without proxy to compare behavior.This error occurs when the SWG proxy cannot validate the destination server’s certificate. Causes include expired, self-signed, or incomplete certificate chains.
Technical Detail: Nginx proxy may fail if the upstream server relies on Authority Information Access (AIA) fetching for missing intermediate certificates, as Nginx does not handle AIA as gracefully as File Scanning proxy service. SNI and SAN mismatches during TLS handshake can also trigger failures.
The 517 error means the SWG proxy’s CRL or OCSP check found the upstream server’s certificate revoked.
Cisco Secure Access will be introducing new feature called "Certificate Error Handling Options" for granular error bypass without disabling decryption entirely. Domains that trigger certificate errors due to inspection can be managed using this feature instead of broad "Do Not Decrypt" lists.
This feature exists in Umbrella SIG as of today. Feature Requests details for CSA.
The 502 error indicates the SWG proxy received an invalid response from the upstream server while acting as an intermediary.
- Downstream: Client to SWG Proxy
- Upstream: SWG Proxy to Destination Server
The error is always in the upstream connection—due to protocol errors, TCP resets, or malformed headers.
Cause: Server requires a cipher not supported by SWG (for example, TLS_CHACHA20_POLY1305_SHA256).
Resolution: Add the domain to Selective Decryption list.
Testing Commands:
With Proxy: curl -x proxy.sig.umbrella.com:80 -v xyz.com:80 curl -x swg-url-proxy-https.sigproxy.qq.opendns.com:443 -vvv -k "https://www.cnn.com" >> null
Without Proxy: curl -v www.xyz.com:80
Mac/Linux: curl -vvv -o /dev/null -k -L www.cnn.com
Windows: curl -vvv -o null -k -L www.cnn.com
Cause: The upstream server requires client-side certificates, which SWG does not support.
Resolution: Bypass the domain from the proxy using the External Domains management list (Umbrella SIG) or Bypass Secure Proxy (Cisco Secure Access). Bypassing HTTPS inspection alone is insufficient.
Cause: Some servers reject requests with the X-Forwarded-For (XFF) header added by SWG when HTTPS inspection is enabled.
Resolution: Compare behavior with/without HTTPS and file inspection. If the error only occurs when XFF is present, the web server is likely misconfigured.
Example: curl https://www.xyz.com -k --header 'X-Forwarded-For: 1.1.1.1' -o /dev/null -w "Status Code: %{http_code}" -s
Status Code: 502 curl https://www.xyz.com -k -o /dev/null -w "Status Code: %{http_code}" -s
Status Code: 200
The XFF header is added for geolocation. If the server cannot process it, a 502 error results.
If SWG cannot scan a file using file inspection (for example, protected, range-requested, or corrupted files), it blocks the download and reports - Blocked – Potentially Unwanted Application (Protected File)
Potentially Harmful Categories and Reputation Blocks
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
18-May-2026
|
Initial Release |