topic Re: Getting hit count on https inspection outbound policy in General Topics

Getting hit count on https inspection outbound policy

the_rock — Fri, 13 Feb 2026 23:08:38 GMT

Hey guys,

Happy weekend 🙂

Apologies if I posted this in wrong space, but could not find management any longer listed anywhere.

Anywho, Im sure I asked this many times before, but since people CONSTANTLY keep asking me, I wanted to bring it up once more. Is there any way to somehow get a hit count enabled for https outbound inspection policy?

I tried writting a script, but no matter what I do, just does not give me what Im looking for.

Thoughts?

Tx as always for helping.

Re: Getting hit count on https inspection outbound policy

Chris_Atkinson — Sat, 14 Feb 2026 11:17:10 GMT

Open an RFE and ask your customers to do the same in consultation with their SE.

https://usercenter.checkpoint.com/ucapps/rfe/

Re: Getting hit count on https inspection outbound policy

the_rock — Sat, 14 Feb 2026 12:11:02 GMT

Hey Chris,

I did that while back actually, but never received any feedback about it. I will keep trying and see if I can somehow make it work.

Re: Getting hit count on https inspection outbound policy

the_rock — Sat, 14 Feb 2026 13:27:37 GMT

I did some search online and found out this is indeed implemented in R82.10, which I did confirm with demo smart console. Gateway would need to be on that version.

Re: Getting hit count on https inspection outbound policy

genisis__ — Sat, 14 Feb 2026 13:56:53 GMT

Funny - I've been looking at HTTPs inspection recently and wanted exactly the same thing i.e hitcount on outbound https policy.

Now - may not be specific to this thread, but the fact you need a SubCA certificate to do HTTPs inspect was also a challenge if I wanted this signed by the clients PrivateCA, basically there is no way they would do that.

I have however created a PrivateCA certificate using OpenSSL (in this way I can add more values to it), and then created a Server Certificate from this with SANs; This is then used for UserCheck.

In this way only the PrivateCA's public cert needs to be imported into the end users devices.

Happy to share the commands used for OpenSSL with the exact parameters that worked for me (Clearly changing the values though).

When testing the only issue I've seen, which is odd, was with cnn.com (have a TAC case open for this).

my HTTPs inspection policy also has all the updateable object with'bypass' in them, as well for Bypass. The SK related to this need to be updated with these additional value as its not been updated since around 2022 (send feedback on this to Checkpoint, via the SK).

Re: Getting hit count on https inspection outbound policy

the_rock — Sat, 14 Feb 2026 13:55:03 GMT

Hey mate,

I tried so many times to see if there is guidbedit setting that can be modified to make this work, but no matter what I try, does not work. O well, now we know its present in R82.10. I still wont give up, will try to make it work on my lab. My mgmt is R82, but cluster is still R81.20, thats cluster where I have my lab win 11 machine "subjected" to ssl inspection.

Re: Getting hit count on https inspection outbound policy

Chris_Atkinson — Sat, 14 Feb 2026 23:55:15 GMT

This slipped past me as well, as you say it's mentioned in the release notes for R82.10

https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SecurityManagement_AdminGuide/Content/Topics-SECMG/Analyzing-the-Rule-Base-Hit-Count.htm?cshid=ID007

Re: Getting hit count on https inspection outbound policy

the_rock — Sat, 14 Feb 2026 23:58:31 GMT

All good brother...none of us are supermen/AIs/robots 😁

Re: Getting hit count on https inspection outbound policy

genisis__ — Mon, 16 Feb 2026 22:15:37 GMT

Managed to figure out why cnn.com was not working, Checkpoint has not loaded the Chain certificate into the trust store, so I loaded it in the custom trust store and it worked.
I found a few others and reported them all to Checkpoint TAC so they can all be considered for the next certificate package update.

Re: Getting hit count on https inspection outbound policy

the_rock — Mon, 16 Feb 2026 22:54:00 GMT

Thats great, thanks for that, @genisis__