Secure Web Proxy now supports the local intermediate CA signing certificate issuance mode for TLS inspection. By using this mode, Secure Web Proxy caches a single intermediate certificate authority (CA) certificate from your CA pool to sign leaf certificates locally for requested domains, reducing certificate issuance requests and transaction costs. To use this certificate issuance mode, you must make sure that your CA pool is configured to issue intermediate CA certificates.

For more information, see Certificate issuance modes and Configure a local intermediate CA signing. This feature is generally available (GA).

You can now use authorization policies to perform identity-based and content-based access control checks when processing outbound traffic requests through Secure Web Proxy.

By configuring authorization policies, you can set rules for your workloads to access external destinations. You can also use these authorization policies to delegate complex authorization decisions to identity and content-scanning services like Service Extensions. This feature is supported in Preview.

Feature

You can integrate frontend mutual TLS (mTLS) with Secure Web Proxy to boost the security of your applications and workloads.

With this integration, you can use validated client identities in Secure Web Proxy authorization policies to enforce granular access control for outbound traffic. This feature is supported in Preview.

When deploying your Secure Web Proxy instance as next hop, you can now configure the gateway to listen on all ports (from 1 to 65535). By using this feature, your proxy can automatically intercept and enforce security policies and rules to all outbound traffic, removing the need to manage specific port lists.

This feature is supported in Preview.

Support for VPC Service Controls is generally available (GA).

Secure Web Proxy (SWP) uses a Cloud Network Address Translation (NAT) gateway to allow external communication between Google Cloud Platform (GCP) workloads and internet destinations. This NAT gateway is automatically provisioned when you set up your SWP instance.

To limit the number of IP addresses being used up, the Cloud NAT gateway now uses dynamic port allocation (DPA) for SWP. This feature is generally available (GA).

You can now configure your Secure Web Proxy (SWP) instance to be a next hop for routing web traffic within your network. To create a next hop, you can use either policy-based routes or static routes.

With the launch of this deployment mode, you now have the flexibility to deploy your SWP instance in explicit proxy mode, as a Private Service Connect (PSC) service attachment, or as a next hop. This feature is now generally available (GA).

The Direct VPC egress feature of Cloud Run now supports Secure Web Proxy. This feature is generally available (GA).

You can now publish Secure Web Proxy (SWP) as a Private Service Connect (PSC) service attachment. With this feature, you can centralize and apply security policies on your egress web traffic. This feature is now generally available (GA).

Secure Web Proxy is generally available (GA).

Cloud Secure Web Proxy supports TLS inspection, which helps you intercept the TLS traffic, inspect the encrypted request, and enforce security policies. This feature is supported in Preview.

Cloud SWG is available in Preview. Cloud SWG provides a secure web gateway that helps you secure egress web traffic (HTTP/S). Contact your sales representative to sign up and use Cloud SWG.