topic Re: https-inspection doesn't let to open some sites in General Topics https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21754#M4058 <HTML><HEAD></HEAD><BODY><P>I found out that a reason is sk120192. Certificate on this site has signature algorithm SHA256withDSA.</P><P>Unfortunately, I can't add this site in exception using Customer Category. I found only one way to set bypass for this site is ip-address in fieild "Destination".</P></BODY></HTML> Tue, 08 May 2018 13:24:07 GMT Mikhail_Kalita 2018-05-08T13:24:07Z https-inspection doesn't let to open some sites https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21749#M4053 <HTML><HEAD></HEAD><BODY><P>Good day! After I enabled https-inspection, I can't open some site. I'm from Belarus. I can't open for exmple this site :</P><P><A class="link-titled" href="https://extmedia.by/" title="https://extmedia.by/">Хостинг и регистрация доменных имен в Беларуси</A>&nbsp;. It's a Belarussian hosting. Which types of sites isn't avaliable to open after launching of https-inspection?</P></BODY></HTML> Mon, 07 May 2018 09:50:35 GMT https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21749#M4053 Mikhail_Kalita 2018-05-07T09:50:35Z Re: https-inspection doesn't let to open some sites https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21750#M4054 <HTML><HEAD></HEAD><BODY><P>Hi Mikhail,</P><P></P><P>Since HTTPS Inspection can not categorize some sites, you will have to manually define bypass&nbsp;rule.</P><P></P><P>Best regards,</P><P>Korkut</P></BODY></HTML> Mon, 07 May 2018 12:22:37 GMT https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21750#M4054 Korkut_Ozcan1 2018-05-07T12:22:37Z Re: https-inspection doesn't let to open some sites https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21751#M4055 <HTML><HEAD></HEAD><BODY><P>I see that for this site:</P><TABLE style="background-color: #fdfdfd; font-size: 12px; margin: 0px 10px 0px 0px;"><TBODY><TR class=""><TD class="" style="color: #444444; border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: #f0f0f0; font-weight: bold; font-size: 12px; padding: 3px 10px 3px 0px;"><SPAN style="color: #f88017;">Chain issues</SPAN></TD><TD class="" style="border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: #f0f0f0; font-size: 12px; padding: 3px 0px;"><SPAN style="color: #f88017;"><STRONG>Incorrect order, Extra certs, Contains anchor</STRONG></SPAN></TD></TR></TBODY></TABLE><P>Can it be a reason that I can't open this site?</P></BODY></HTML> Mon, 07 May 2018 14:29:46 GMT https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21751#M4055 Mikhail_Kalita 2018-05-07T14:29:46Z Re: https-inspection doesn't let to open some sites https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21752#M4056 <HTML><HEAD></HEAD><BODY><P>Hi:</P><P>Are they ECDHE sites?</P><P>Reference:<BR />Specific HTTPS sites that use ECDHE ciphers are not accessible when HTTPS Inspection is enabled<BR />Solution ID sk110883</P><P></P><P>Some HTTPS sites do not load when HTTPS Inspection is enabled, if TLS 1.2 with ECDHE cipher is used<BR />Solution ID sk112954</P></BODY></HTML> Mon, 07 May 2018 15:33:19 GMT https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21752#M4056 Neville_Kuo 2018-05-07T15:33:19Z Re: https-inspection doesn't let to open some sites https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21753#M4057 <HTML><HEAD></HEAD><BODY><P>Looks like an SNI issue. Search this forum for another post regarding HTTPS and SNI.</P></BODY></HTML> Mon, 07 May 2018 17:36:43 GMT https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21753#M4057 Vladimir 2018-05-07T17:36:43Z Re: https-inspection doesn't let to open some sites https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21754#M4058 <HTML><HEAD></HEAD><BODY><P>I found out that a reason is sk120192. Certificate on this site has signature algorithm SHA256withDSA.</P><P>Unfortunately, I can't add this site in exception using Customer Category. I found only one way to set bypass for this site is ip-address in fieild "Destination".</P></BODY></HTML> Tue, 08 May 2018 13:24:07 GMT https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21754#M4058 Mikhail_Kalita 2018-05-08T13:24:07Z Re: https-inspection doesn't let to open some sites https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21755#M4059 <HTML><HEAD></HEAD><BODY><P>Using the CP as a proxy alleviates the need to use IPs for bypasses. Please see further reading here:&nbsp;<A href="https://community.checkpoint.com/thread/7621">HTTPS inspection real life examples and caveats in R77.30 and R80.10</A>&nbsp;</P></BODY></HTML> Mon, 02 Jul 2018 10:40:42 GMT https://community.checkpoint.com/t5/General-Topics/https-inspection-doesn-t-let-to-open-some-sites/m-p/21755#M4059 Albert_Wilkes 2018-07-02T10:40:42Z