Size TLS interception: how much traffic you actually decrypt after bypass, and whether the device's derated capacity covers it.
TLS interception is the most expensive inspection a device performs: it terminates the client session, re-establishes an outbound session and does full crypto in both directions, which typically leaves only 20–30% of rated throughput. Bypass policy is the main lever — every category you exempt comes straight off the decrypt load. TLS inspection sizing errors are the most common cause of security-driven outages, because the derate is a factor of four or five and datasheets lead with the L4 number.
SSL Inspection
decrypted = offered load × TLS share × (1 − bypass share); capacity = rated throughput × TLS derate (typically 20–30%).
decrypted = offered load × TLS share × (1 − bypass share); capacity = rated throughput × TLS derate (typically 20–30%). TLS interception is the most expensive inspection a device performs: it terminates the client session, re-establishes an outbound session and does full crypto in both directions, which typically leaves only 20–30% of rated throughput. Bypass policy is the main lever — every category you exempt comes straight off the decrypt load.
TLS inspection sizing errors are the most common cause of security-driven outages, because the derate is a factor of four or five and datasheets lead with the L4 number.
This calculator takes 7 inputs: Rated L4 throughput of the device, Peak offered load, Share of traffic that is TLS, Share of TLS bypassed by policy, Throughput remaining with TLS inspection enabled, TLS handshakes per second, Device handshake capacity. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Anything using certificate pinning will simply break — many mobile apps, update services and API clients validate the expected certificate and reject your interception certificate. Add to that whatever your jurisdiction or policy exempts on privacy grounds, typically banking, healthcare and government sites. Build the bypass list from pinning failures first, then privacy, then capacity.