Global Secure Access

How to generate the Entra TLS inspection Subordinate CA CSR, correct the certificate template, issue a new SubCA from an internal PKI, and validate it before enabling TLS inspection in Global Secure Access.

TLS inspection in Global Secure Access looks simple on a slide and painful in production. This post cuts through the marketing and focuses on what actually works, what breaks, and how to deploy it safely.