Replacement Messages for HTTPS-based Applications?

[fjulianom]

Hi community,

I have found this in Fortinet documentation:

Replacement Messages for HTTP-based Applications allows you to replace blocked content with an explanation (for the user's benefit). With non-HTTP/HTTPS applications, however, you can only drop the packets or reset the TCP connection.

But it doesn't explain why FortiGate doesn't show a replacement message for HTTPS application. Any ideas?

Regards,

Julián  

[AlexC-FTNT]

Hi Julián ,

There were many changes of this behavior throughout the various firmware versions. So an answer may not be universally valid for all versions.

Simply put, in order to display the replacement message in a HTTPS stream, it needs to break the connection to insert its data. This change can be detected by the browser (because the FortiGate can't sign the connection with the same certificate as the destination website) and dropped. Or, this intercept is simply not possible, like for HSTS sites.