Why do content filter block/warn pages fail to display on HSTS-enabled websites?

Zyxel_James

Question: Why do content filter block/warn pages fail to display on HSTS-enabled websites?

Answer:
This behavior is an expected limitation caused by HSTS (HTTP Strict Transport Security) enforcement, not a product defect.

HSTS requires that the certificate be valid for the exact domain being accessed. It is not sufficient for a certificate to be merely signed by a trusted public Certificate Authority (CA); its Common Name (CN) must specifically match the requested hostname.

Therefore, using a customer's own trusted certificate will not resolve the issue. The certificate's CN would not match the specific blocked domain, leading to security errors (such as those seen in Firefox) that prevent the block/warn page from displaying.