R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject

[Scott_Paisley]

We are just turning on URL filtering in the estate.

Categorize HTTPS sites is enabled.

We have rule that is set to DROP, with a Block message for certain sites or categories

If we visit http://badsite.com, the log shows a BLOCK and we get the block page on the client machine.

If we visit the same site with https://badsite.com, the log shows REJECT, but the website opens on the client.

The CN on the certificate maches the name of the site.

I have a support ticket open, but anyone else seen this or solved it?

[HeikoAnkenbrand · Accepted solution]

Hi @Scott_Paisley 

https://badsite.com is a self-signed certificate website.

Outbound HTTPS Inspection of self-signed certificate websites or a site with certicicate issues may fail with various errors:

- CRL Validations failure logs
- Self-Signed certificate failure logs
- HTTPS Validation failure logs or Reject logs

By design, when HTTPS Inspection is enabled, CRL Validation is also enabled by default.

Therefore, inspecting traffic towards a website that owns a self-signed certificate (without a Root-CA / Sub-Root-CA) will fail because of the CRL Validation feature, which validates expiry, all certificate chains and their order, trust state, and more.

More read here: sk148352 

[Ortod_Zumbuehl]

I had the same problem and that was the solution.

[Liel_Shaish]

Hi,

With HTTPS websites categorization, there is additional secure protocol layer .

Before accessing the website, the GW will verify the server certificate. In case the validation fails, the site will be considered as uncategorized and will be enforced according to the defined rule base. In this case need to examine the reason for the validation failure and to verify that the policy contains rules that cover these cases (e.g. cleanup rule of dropping uncategorized sites) 

In case site is using self-signed certificate ,probably the CA is missing from the trusted CAs list . In case you trust this CA you can follow sk148352