SSL browsers warning when trying to access to deny SSL websites.

Problem

Following this setup:

1. All the traffic is blocked.
2. Only certain websites are allowed through access lists.
3. It is checking both HTTP & HTTPS traffic.
4. For all allowed website, it is bypassing ‘MAN IN THE MIDDLE’ and redirect the original SSL through SSL Rules.

Your facing issues with the SSL implementation…

You have created self-signed certificate and configured SSL as per the guidelines.

You have also downloaded the generated certificate and installed in the client computer under ‘Trusted Root Certificate Authorities’. You still get the certificate error when clients PC try to surf any blocked website.

This is what happens:

1. Client try to visit any blocked SSL site. Ex. https://www.youtube.com
2. Client get the ‘certificate warning’.
3. When clicks on allow:
   1. For IE, it shows the ‘RED Error Page.
   2. For Google Chrome, It stays at error page, explaining that the certificate is not trusted.

Solution

This error is normal, when the request is deny, the proxy forward the connection to the proxy box web server in order to serve the deny web page in SSL mode.

The deny SSL web page must be configured with the following parameters:

1. The URL must point to the domain defined in the certificate or if you have created a self certificate and import it into browsers you can keep the same URL.
2. You have to define the same the certificate used by the proxy on the Web SSL error page.

• On the TOP menu, click on Your Proxy button.
• Choose the link “Banned page service“

• You will be redirected to the Banned page service main configuration.
• Down to the end of this section.

• Modify the desired hostname value. It should be an IP address or an fully qualified host name.
• Choose the certificate used by the proxy  in the “Certificate” drop-down list.
• Click on Apply button.