cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution

R80.20+  with enabled HTTPS interception:

If the https interception is enabled, the parameter host from http header can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS, VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.) 

More read here: R80.x Security Gateway Architecture (Content Inspection) 

 

R80.20+ without enabled HTTPS interception (SNI is used):

If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

More read here: URL Filtering using SNI for HTTPS websites.pdf 

1 Solution

Accepted Solutions

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution

Yes! SNI works without enabled HTTPS decryption. If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

View solution in original post

Tags (1)
7 Replies
Admin
Admin

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution
Hi, just to make a small correction to the above, there are customer-specifix hotfixes for SNI support on R80.10 and R80.20.
Note that with customer-specific fixes you won't necessarily be able to use recent jumbo hotfixes.
R80.30 has this integrated, enabled by default, and we actually verify the SNI requested by the client.
It is by far the better option.
Til_Hall
Ivory

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution

I'm a little bit confused!

Can SNI be used without enabled HTTPS encryption?

0 Kudos

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution

Yes! SNI works without enabled HTTPS decryption. If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

View solution in original post

Tags (1)
Admin
Admin

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution
Only with JHF117 or above installed.
Otherwise, SNI is NOT used for App Control/URL Filtering.
0 Kudos

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution
is this on the roadmap for R80.20SP as well? Any target JHF?
0 Kudos
Highlighted

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution

is this on the roadmap for R80.20SP as well? Any target JHF?

Admin
Admin

Re: R80.20 - SNI vs. enabled HTTPS Interception

Jump to solution
It's planned for the near term, yes, but not familiar with the exact JHF it is planned.