HTTPS traffic filtering

HTTPS traffic filtering is a security mechanism that

  • determines the requested URL based on information passed during the TLS/SSL handshake using the subject common name in the public key certificate,

  • disregards subdomains within the subject common name, requiring manual filtering to use top-level domains only, and

  • does not support URL lists, requiring the use of URL objects and groups instead.

HTTPS filtering characteristics

There are several key differences between HTTPS filtering and HTTP filtering:

  • Do not include subdomain information when manually filtering HTTPS URLs in access control or QoS policies. For example, use example.com instead of www.example.com.

Tip

In an decryption policies, you can handle and decrypt traffic to specific URLs by defining a distinguished name decryption policy rule condition. The common name attribute in the subject distinguished name of a certificate contains the site's URL. Decrypting HTTPS traffic allows access control rules to evaluate the decrypted session, which improves URL filtering.

Traffic control by encryption protocol:

The system disregards the encryption protocol (HTTP vs HTTPS) when performing URL filtering in access control or QoS policies. This occurs for both manual and reputation-based URL conditions. In other words, URL filtering treats traffic to these websites identically:

  • http://example.com/

  • https://example.com/

To configure a rule that matches only HTTP or HTTPS traffic, add an application condition to the rule. For example, you could allow HTTPS access to a site while disallowing HTTP access by constructing two access control rules, each with an application and URL condition.

Application-specific URL filtering rules

The first rule allows HTTPS traffic to the website:

  • Action: Allow

  • Application: HTTPS

  • URL: example.com

The second rule blocks HTTP access to the same website:

  • Action: Block

  • Application: HTTP

  • URL: example.com