Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Scott_Paisley
Advisor
Jump to solution

R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject

We are just turning on URL filtering in the estate.

Categorize HTTPS sites is enabled.

We have rule that is set to DROP, with a Block message for certain sites or categories

If we visit http://badsite.com, the log shows a BLOCK and we get the block page on the client machine.

If we visit the same site with https://badsite.com, the log shows REJECT, but the website opens on the client.

The CN on the certificate maches the name of the site.

I have a support ticket open, but anyone else seen this or solved it?

 

1 Solution

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

Hi @Scott_Paisley 

https://badsite.com is a self-signed certificate website.

Outbound HTTPS Inspection of self-signed certificate websites or a site with certicicate issues may fail with various errors:

- CRL Validations failure logs
- Self-Signed certificate failure logs
- HTTPS Validation failure logs or Reject logs

By design, when HTTPS Inspection is enabled, CRL Validation is also enabled by default.

Therefore, inspecting traffic towards a website that owns a self-signed certificate (without a Root-CA / Sub-Root-CA) will fail because of the CRL Validation feature, which validates expiry, all certificate chains and their order, trust state, and more.

More read here: sk148352 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

3 Replies
HeikoAnkenbrand
Champion Champion
Champion

Hi @Scott_Paisley 

https://badsite.com is a self-signed certificate website.

Outbound HTTPS Inspection of self-signed certificate websites or a site with certicicate issues may fail with various errors:

- CRL Validations failure logs
- Self-Signed certificate failure logs
- HTTPS Validation failure logs or Reject logs

By design, when HTTPS Inspection is enabled, CRL Validation is also enabled by default.

Therefore, inspecting traffic towards a website that owns a self-signed certificate (without a Root-CA / Sub-Root-CA) will fail because of the CRL Validation feature, which validates expiry, all certificate chains and their order, trust state, and more.

More read here: sk148352 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Ortod_Zumbuehl
Explorer

I had the same problem and that was the solution.

0 Kudos
Liel_Shaish
Employee
Employee

Hi,

With HTTPS websites categorization, there is additional secure protocol layer .

Before accessing the website, the GW will verify the server certificate. In case the validation fails, the site will be considered as uncategorized and will be enforced according to the defined rule base. In this case need to examine the reason for the validation failure and to verify that the policy contains rules that cover these cases (e.g. cleanup rule of dropping uncategorized sites) 

In case site is using self-signed certificate ,probably the CA is missing from the trusted CAs list . In case you trust this CA you can follow sk148352

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events