Some users experience connection issues with Tenacy or notice significant slowness in the interface: this may be caused by an SSL proxy / TLS inspection (SSL decryption) on your network. In this article, we explain what this inspection is, how it can impact Tenacy, how to diagnose it, and what actions to request from your network team.
If you encounter this screen after starting authentication, continue reading this article to understand what is happening:
What is SSL inspection / TLS decryption?
SSL or TLS decryption (TLS = the modern version of SSL) is a technique used by certain firewalls or security proxies: HTTPS traffic between the user and the server is decrypted (inspected), analyzed, then re-encrypted before being sent to its destination.
This allows the company to gain visibility into the content of encrypted communications for security reasons (DLP, intrusion prevention, etc.).
However, inspection can affect performance, especially if the proxy forces traffic to use HTTP/1.1 instead of HTTP/2 (multiplexing, parallel requests, etc.).
Why SSL inspection / a proxy can affect Tenacy
Here is how an SSL proxy can impact the Tenacy experience:
Increased latency / longer loading times
If the proxy replays or slows down HTTPS exchanges, the Tenacy interface may take much longer to load.
“Downgrading” from HTTP/2 to HTTP/1.1 (or the lack of full HTTP/2 support) can make transactions sequential instead of parallel, significantly slowing down exchanges.
SSL errors or connection failures
In some cases, the proxy may incorrectly handle TLS negotiation, preventing connection to Tenacy.
The proxy may not accept certain cipher suites or TLS versions, or the client / server machine may not support the same configurations, blocking connection establishment.
SSL inspectors not compatible with HTTP/2
Some inspectors do not fully support the HTTP/2 protocol: if they do not handle multiplexing or simultaneous requests, the user experience will be degraded.
Diagnosing whether an SSL proxy / TLS inspector is responsible — and how to fix it
To confirm whether this issue applies to you, you need to check with your network team. Depending on the answer, here are several elements that can help resolve the problem:
If yes, ask whether Tenacy domains (for example .tenacy.io or your custom domains) are excluded from TLS inspection.
If not, suggest adding your Tenacy domains to a decryption exclusion list (whitelist), so that the proxy does not inspect this traffic.
Also check the proxy configuration: Does it support HTTP/2? Does it force a downgrade to HTTP/1.1?
💡 If despite these actions you are still blocked and unable to access Tenacy, please contact our support team through the chat bubble or by email at [email protected].