[Cloudflare One] Document TLS inspection requirement for authorization proxy endpoints (#31125)

* [Cloudflare One] Document TLS inspection requirement for authorization proxy endpoints

Authorization proxy endpoints always perform TLS decryption to read the
auth cookie, regardless of account-level TLS settings. Add this as a
documented limitation and clarify the certificate install step.

* [Cloudflare One] Fix passive voice in TLS inspection docs

* [Cloudflare One] Clarify certificate requirements

---------

Co-authored-by: aj <aj@cloudflare.com>
Co-authored-by: Matt Silverlock <matt@eatsleeprepeat.net>

Author: 3 people

src/content/docs/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/index.mdx

@@ -314,7 +314,7 @@ Each account has a maximum number of proxy endpoints:
 
 ### 3a. Install Cloudflare certificate
 
-To use Gateway HTTP policies with proxy endpoints, you must [install a Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your devices. This allows Gateway to inspect HTTPS traffic and apply policies such as blocking specific domains or displaying the Gateway block page.
+You must [install a Cloudflare certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/) on your devices. Authorization endpoints use the certificate to inspect TLS traffic and read the authorization cookie. Source IP endpoints use the certificate to apply Gateway HTTP policies such as blocking specific domains or displaying the Gateway block page.
 
 ### 3b. Configure browser to use PAC file
 
@@ -498,6 +498,10 @@ Each user who authenticates through an authorization proxy endpoint occupies a [
 
 When using [authorization endpoints](#authorization-endpoint), be aware of the following limitations. For configuration guidance on apps with certificate pinning, refer to [PAC file best practices](/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/best-practices/#apps-with-certificate-pinning).
 
+#### TLS inspection required
+
+Authorization endpoints require [TLS inspection](/cloudflare-one/traffic-policies/http-policies/tls-decryption/) on all proxied traffic. Gateway must decrypt HTTPS requests to read the authorization cookie that identifies each user session. Gateway always performs TLS decryption for traffic routed through an authorization endpoint, even if you turn off TLS decryption at the account level. You cannot selectively bypass TLS inspection for specific destinations when using an authorization endpoint.
+
 #### Plaintext HTTP traffic
 
 Authorization endpoints do not support plaintext HTTP traffic unless the traffic is configured through an [Access application](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) or bypassed with the PAC file.