In an explicit proxy environment, if the Netskope Client cannot establish the SSL tunnel directly through the default gateway, it must use the proxy path to reach the Netskope gateway. Netskope’s client flow explains that when direct connectivity is blocked, the client looks for system proxy settings such as PAC, WPAD, or manual proxy configuration and then connects to the Netskope gateway using HTTP CONNECT. That is why the best answer is to use an HTTP proxy server to tunnel the SSL connection to the Netskope gateway. Installing proxy decryption certificates does not solve the tunnel-establishment path problem. Merely allowing domains and port 443 is incomplete when direct gateway access is blocked. The key requirement is proxy-based HTTP CONNECT tunneling.

================