MITM Eligibility

Patronus attempts to inspect supported encrypted AI traffic through its local mitmproxy CA. Some traffic cannot be inspected reliably. When inspection is not eligible, Patronus records the reason and lets that traffic pass through instead of breaking the application.

This is a fail-open bypass for compatibility. It means Patronus avoids interrupting the application, but the bypassed request is not inspected.

Why Traffic Can Become Ineligible

Traffic can become ineligible for inspection when:

• the client application rejects the local mitmproxy CA,
• the client uses certificate pinning or a private trust store,
• the client closes the TLS handshake after Patronus presents an inspection certificate,
• the communication protocol is not one Patronus can safely process,
• the observed connection lacks enough host or SNI information to inspect safely.

When Patronus sees client TLS failures such as unknown ca, bad certificate, certificate unknown, or an early connection close, it records inspection debt for that app, source context, host, port, and protocol.

What Happens Next

After an inspection failure is recorded, matching traffic is treated as tls_pass_through instead of inspectable_tls.

The bypass key includes:

Field	Meaning
App ID	The application associated with the connection, or unknown.
Source context	The capture context that observed the connection.
Host or SNI	The destination host used for TLS inspection decisions.
Port	Usually 443, unless another destination port is observed.
Protocol	Usually tcp.

Patronus keeps the first seen time, last seen time, hit count, reason, and evidence for the bypass entry.

Where To See It

Bypassed entries are shown in the Dashboard under Whitelisted.

Use that list to understand which apps or destinations Patronus could not inspect. A whitelisted entry does not mean the destination is trusted. It means Patronus detected that inspection would break or mishandle that traffic and therefore passed it through.

Common Reasons

Reason	Meaning
client_rejected_patronus_ca	The client did not accept the local mitmproxy CA during TLS inspection.
client_tls_handshake_failed	Patronus observed the TLS handshake fail while attempting inspection.

If a runtime should be inspectable but appears under Whitelisted, check the runtime CA settings first. For Node, Python, curl, pip, and Docker, see Runtime CA Support.