- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- R80.20 URL filter blocks HTTP, but allows HTTPS ev...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject
We are just turning on URL filtering in the estate.
Categorize HTTPS sites is enabled.
We have rule that is set to DROP, with a Block message for certain sites or categories
If we visit http://badsite.com, the log shows a BLOCK and we get the block page on the client machine.
If we visit the same site with https://badsite.com, the log shows REJECT, but the website opens on the client.
The CN on the certificate maches the name of the site.
I have a support ticket open, but anyone else seen this or solved it?
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
https://badsite.com is a self-signed certificate website.
Outbound HTTPS Inspection of self-signed certificate websites or a site with certicicate issues may fail with various errors:
- CRL Validations failure logs
- Self-Signed certificate failure logs
- HTTPS Validation failure logs or Reject logs
By design, when HTTPS Inspection is enabled, CRL Validation is also enabled by default.
Therefore, inspecting traffic towards a website that owns a self-signed certificate (without a Root-CA / Sub-Root-CA) will fail because of the CRL Validation feature, which validates expiry, all certificate chains and their order, trust state, and more.
More read here: sk148352
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
https://badsite.com is a self-signed certificate website.
Outbound HTTPS Inspection of self-signed certificate websites or a site with certicicate issues may fail with various errors:
- CRL Validations failure logs
- Self-Signed certificate failure logs
- HTTPS Validation failure logs or Reject logs
By design, when HTTPS Inspection is enabled, CRL Validation is also enabled by default.
Therefore, inspecting traffic towards a website that owns a self-signed certificate (without a Root-CA / Sub-Root-CA) will fail because of the CRL Validation feature, which validates expiry, all certificate chains and their order, trust state, and more.
More read here: sk148352
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had the same problem and that was the solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
With HTTPS websites categorization, there is additional secure protocol layer .
Before accessing the website, the GW will verify the server certificate. In case the validation fails, the site will be considered as uncategorized and will be enforced according to the defined rule base. In this case need to examine the reason for the validation failure and to verify that the policy contains rules that cover these cases (e.g. cleanup rule of dropping uncategorized sites)
In case site is using self-signed certificate ,probably the CA is missing from the trusted CAs list . In case you trust this CA you can follow sk148352
