Everyone just parrots the "whitelist the top 100 financial sites" rule. Until your CFO can't submit the quarterly report because your decryption policy broke their obscure municipal bond portal that uses a pinned certificate from 2017.
The best practice is a nice, clean list. Reality is a sprawling, brittle mess of exemptions that grows organically after every support ticket. You're not managing policy; you're managing exceptions.
Here's the config snippet that usually starts the problem. You think you're being clever.
```
ssl-decrypt {
enable
exclude-category "Finance"
}
```
Great. Now watch as half your "financial" traffic goes un-inspected because the category is too broad, and the other half breaks because some "non-financial" vendor uses a banking gateway for payments. The category lists are laughably outdated.
I've moved to a hybrid model that everyone seems to hate: decrypt everything by default, then use a combination of SNI-based whitelists *and* user-agent detection for specific legacy platforms. Yes, it's more work. Yes, you'll need to actually look at your logs. The alternative is a porous security boundary dressed up as compliance.
The real question isn't *how* you build the list. It's who owns the fallout when it inevitably breaks something critical. Is it the security team's policy, or the help desk's ticket queue? That's the policy that matters.