Secure Web Proxy now supports the local intermediate CA signing certificate issuance mode for TLS inspection. By using this mode, Secure Web Proxy caches a single intermediate certificate authority (CA) certificate from your CA pool to sign leaf certificates locally for requested domains, reducing certificate issuance requests and transaction costs. To use this certificate issuance mode, you must make sure that your CA pool is configured to issue intermediate CA certificates.

For more information, see Certificate issuance modes and Configure a local intermediate CA signing. This feature is generally available (GA).

You can now use authorization policies to perform identity-based and content-based access control checks when processing outbound traffic requests through Secure Web Proxy.

By configuring authorization policies, you can set rules for your workloads to access external destinations. You can also use these authorization policies to delegate complex authorization decisions to identity and content-scanning services like Service Extensions. This feature is available in Preview.

Feature

You can integrate frontend mutual TLS (mTLS) with Secure Web Proxy to boost the security of your applications and workloads.

With this integration, you can use validated client identities in Secure Web Proxy authorization policies to enforce granular access control for outbound traffic. This feature is available in Preview.

When deploying your Secure Web Proxy instance as a next hop, you can now configure the gateway to listen on all ports (from 1 to 65535). By using this feature, your proxy can automatically intercept and enforce security policies and rules to all outbound traffic, removing the need to manage specific port lists.

This feature is available in Preview.

Secure Web Proxy now supports VPC Service Controls. For more information, see Configure VPC Service Controls for Secure Web Proxy.

This feature is generally available (GA).

Secure Web Proxy uses a Cloud NAT gateway to allow external communication between Google Cloud workloads and internet destinations. When you set up your Secure Web Proxy instance, a network address translation (NAT) gateway is automatically created.

To limit the number of IP addresses that are used, the Cloud NAT gateway now uses dynamic port allocation (DPA) for Secure Web Proxy. For more information, see Use Cloud NAT for Secure Web Proxy.

This feature is generally available (GA).

You can now configure your Secure Web Proxy instance as a next hop to route web traffic within your Virtual Private Cloud (VPC) network. To deploy your Secure Web Proxy instance as a next hop, you can use either policy-based routes or static routes.

This feature is generally available (GA).

The Direct Virtual Private Cloud (VPC) egress feature of Cloud Run now supports Secure Web Proxy. This feature is generally available (GA).

You can now deploy your Secure Web Proxy instance as a Private Service Connect (PSC) service attachment. Use this deployment mode to centralize and apply gateway security policies on your outbound web traffic.

This feature is generally available (GA).

Secure Web Proxy is now generally available (GA).

Secure Web Proxy now supports Transport Layer Security (TLS) inspection. You can use TLS inspection to intercept TLS traffic, inspect encrypted requests, and enforce gateway security policies and rules.

This feature is available in Preview.

Secure Web Proxy acts as a web gateway that helps protect your outbound HTTP and HTTPS traffic. To sign up to use Secure Web Proxy, contact your sales representative.

Secure Web Proxy is now available in Preview.