TLS Inspection Overview
TLS/SSL Inspection and ScreenMeet Compatibility
Overview
This article is intended for IT and network security administrators in environments where TLS/SSL inspection (also called SSL decryption or deep packet inspection) is enabled. It explains how TLS inspection affects ScreenMeet functionality and describes the required network exception to ensure full compatibility.
How TLS Inspection Affects ScreenMeet
TLS inspection works by intercepting encrypted traffic, decrypting it for analysis, and re-encrypting it using a certificate issued by your organization's root CA. Because ScreenMeet client software validates the certificate chain for connections to ScreenMeet servers, this interception breaks that validation. The behavior varies by feature:
ScreenMeet Live and Remote Support (Attended)
When TLS inspection is active, users attempting to connect to a ScreenMeet session will encounter a security warning indicating the connection may not be secure. This is expected behavior — the warning is triggered by the certificate mismatch introduced by your inspection appliance, not by an actual threat. The session may still function, but the warning will appear on every connection attempt.
Example warning text:
WARNING: The connection to the support server may not be secure because of an SSL
certificate mismatch. If you are connected via a VPN, your traffic might be monitored.
Certificate Issuer: CN=[Your Organization's Root CA]. Are you sure you wish to continue?Certificate Pinning
ScreenMeet uses certificate pinning to protect against man-in-the-middle attacks. The security warning in TLS-inspected environments is a false positive caused by your organization's inspection certificate, not an indication of a real threat.
ScreenMeet Beam (Unattended)
Beam will not connect at all when TLS inspection is active. This is intentional — the Beam client enforces strict certificate validation and will refuse to establish a connection if the certificate chain does not match. There is no workaround for Beam other than bypassing TLS inspection for ScreenMeet traffic.
Beam Requires Bypass
Beam (unattended remote access) will not function under TLS inspection under any circumstances. A bypass exception for *.screenmeet.com is required for Beam to connect.
Required Configuration
Configure your network security solution to bypass TLS/SSL inspection for all traffic to and from the following domain:
*.screenmeet.com
This bypass must apply to both inbound and outbound traffic. Refer to the documentation for your specific security solution below.
Configuration References by Vendor
The following vendors are commonly deployed in enterprise environments with TLS inspection enabled. Consult the linked documentation for steps to add a bypass exception.
Vendor | Documentation |
|---|---|
Zscaler | |
Blue Coat ProxySG | Refer to your vendor documentation for SSL interception bypass rules. |
Cisco Umbrella | |
Palo Alto Networks NGFW | |
Fortinet FortiGate |
Other Vendors
If your security solution is not listed here, search your vendor's documentation for "SSL inspection bypass" or "decryption exclusion" and add *.screenmeet.com as an excluded domain.