Skip to main content
fjulianom
fjulianom
Explorer II
February 4, 2022
Question

Replacement Messages for HTTPS-based Applications?

  • February 4, 2022
  • 1 reply
  • 5408 views

Hi community,

 

I have found this in Fortinet documentation:

 

Replacement Messages for HTTP-based Applications allows you to replace blocked content with an explanation (for the user's benefit). With non-HTTP/HTTPS applications, however, you can only drop the packets or reset the TCP connection.

 

But it doesn't explain why FortiGate doesn't show a replacement message for HTTPS application. Any ideas?

 

Regards,

Julián  

1 reply

AlexC-FTNT
Staff
AlexC-FTNT
Staff
February 4, 2022

Hi Julián ,

There were many changes of this behavior throughout the various firmware versions. So an answer may not be universally valid for all versions.

Simply put, in order to display the replacement message in a HTTPS stream, it needs to break the connection to insert its data. This change can be detected by the browser (because the FortiGate can't sign the connection with the same certificate as the destination website) and dropped. Or, this intercept is simply not possible, like for HSTS sites. 

Terms & ConditionsAccessibility statement