Trendmicro application identified as "ssl" despite of proper SNI, CN, SAN.

[V.Sambath]

• We have the Trend Micro agent installed on the endpoints, and it is running smoothly. However, the application is still being identified as "ssl", even though the packet captures show the correct SNI value in the Client Hello. In the Server Hello, both the SAN and CN fields contain multiple wildcard entries ending with *.trendmicro.com.
  
  

• The URL category is successfully identified as “Trendmicro.”

We filtered for the Server Hello packets and confirmed that the certificate includes the Common Name and SAN fields with multiple wildcard entries ending in *.trendmicro.com.

We are not opting for App Override or creating a custom application because the other firewalls are able to identify this traffic correctly even without decryption.