cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject

Jump to solution

We are just turning on URL filtering in the estate.

Categorize HTTPS sites is enabled.

We have rule that is set to DROP, with a Block message for certain sites or categories

If we visit http://badsite.com, the log shows a BLOCK and we get the block page on the client machine.

If we visit the same site with https://badsite.com, the log shows REJECT, but the website opens on the client.

The CN on the certificate maches the name of the site.

I have a support ticket open, but anyone else seen this or solved it?

 

1 Solution

Accepted Solutions
Highlighted

Re: R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject

Jump to solution

Hi @Scott_Paisley 

https://badsite.com is a self-signed certificate website.

Outbound HTTPS Inspection of self-signed certificate websites or a site with certicicate issues may fail with various errors:

- CRL Validations failure logs
- Self-Signed certificate failure logs
- HTTPS Validation failure logs or Reject logs

By design, when HTTPS Inspection is enabled, CRL Validation is also enabled by default.

Therefore, inspecting traffic towards a website that owns a self-signed certificate (without a Root-CA / Sub-Root-CA) will fail because of the CRL Validation feature, which validates expiry, all certificate chains and their order, trust state, and more.

More read here: sk148352 

View solution in original post

3 Replies
Highlighted

Re: R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject

Jump to solution

Hi @Scott_Paisley 

https://badsite.com is a self-signed certificate website.

Outbound HTTPS Inspection of self-signed certificate websites or a site with certicicate issues may fail with various errors:

- CRL Validations failure logs
- Self-Signed certificate failure logs
- HTTPS Validation failure logs or Reject logs

By design, when HTTPS Inspection is enabled, CRL Validation is also enabled by default.

Therefore, inspecting traffic towards a website that owns a self-signed certificate (without a Root-CA / Sub-Root-CA) will fail because of the CRL Validation feature, which validates expiry, all certificate chains and their order, trust state, and more.

More read here: sk148352 

View solution in original post

Re: R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject

Jump to solution

I had the same problem and that was the solution.

0 Kudos
Employee
Employee

Re: R80.20 URL filter blocks HTTP, but allows HTTPS even though log shows reject

Jump to solution

Hi,

With HTTPS websites categorization, there is additional secure protocol layer .

Before accessing the website, the GW will verify the server certificate. In case the validation fails, the site will be considered as uncategorized and will be enforced according to the defined rule base. In this case need to examine the reason for the validation failure and to verify that the policy contains rules that cover these cases (e.g. cleanup rule of dropping uncategorized sites) 

In case site is using self-signed certificate ,probably the CA is missing from the trusted CAs list . In case you trust this CA you can follow sk148352

0 Kudos