Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fjulianom
New Contributor III

Replacement Messages for HTTPS-based Applications?

Hi community,

 

I have found this in Fortinet documentation:

 

Replacement Messages for HTTP-based Applications allows you to replace blocked content with an explanation (for the user's benefit). With non-HTTP/HTTPS applications, however, you can only drop the packets or reset the TCP connection.

 

But it doesn't explain why FortiGate doesn't show a replacement message for HTTPS application. Any ideas?

 

Regards,

Julián  

1 REPLY 1
AlexC-FTNT
Staff
Staff

Hi Julián ,

There were many changes of this behavior throughout the various firmware versions. So an answer may not be universally valid for all versions.

Simply put, in order to display the replacement message in a HTTPS stream, it needs to break the connection to insert its data. This change can be detected by the browser (because the FortiGate can't sign the connection with the same certificate as the destination website) and dropped. Or, this intercept is simply not possible, like for HSTS sites. 


- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -