Bypass Telegram App traffic for ssl decryption

[BigPalo]

Hi,

Is there any way to bypass the Telegram app traffic for SSLdecrypt? any idea?

[LAYER_8]

Firewalls are positive enforcement, meaning they will only do explicitly what you tell them to.

If you don't have a rule to decrypt telegram, it won't happen. 

If telegram is being picked up as a different app, you can create or modify existing App-IDs to get granular enough to exclude/include.

If you are a user on a corporate network that IS decrypting telegram, this isn't the place to talk about offensive sec and product bypassing 🙂

[BigPalo]

The SSL decrypt rule are based on categories. So no option to only no decrypt "telegram".

[LAYER_8]

You have the ability to create custom categories (EDLs, static lists, etc)

[laurence64]

Hi 

SSL Decrypt is controlled via URL category and you can also use ports within the Decrypt policy, frankly I am shocked that Telegram does not use a pinned-cert, if it did it would be in the Decryption exclusion list Device > SSL Decryption Exclusion  however the best thing to do would be (in the absence of any useful info on the Telegram website) carry out a packet capture on the firewall and identify the traffic in question and more accurately check where the app is going URL wise.

A good starting point would be a custom URL category with Telegram added and then a do not decrypt policy above your broad decryption policy, however the packet capture would show the detail and this could also be added to the URL category.