Why do content filter block/warn pages fail to display on HSTS-enabled websites?
Options
Zyxel_James
Posts: 839 
Zyxel Employee
Zyxel Employee
Question: Why do content filter block/warn pages fail to display on HSTS-enabled websites?
Answer:
This behavior is an expected limitation caused by HSTS (HTTP Strict Transport Security) enforcement, not a product defect.
HSTS requires that the certificate be valid for the exact domain being accessed. It is not sufficient for a certificate to be merely signed by a trusted public Certificate Authority (CA); its Common Name (CN) must specifically match the requested hostname.
Therefore, using a customer's own trusted certificate will not resolve the issue. The certificate's CN would not match the specific blocked domain, leading to security errors (such as those seen in Firefox) that prevent the block/warn page from displaying.
0
Categories
- All Categories
- 442 Beta Program
- 3K Nebula
- 234 Nebula Ideas
- 132 Nebula Status and Incidents
- 6.7K Security
- 691 USG FLEX H Series
- 365 Security Ideas
- 1.8K Switch
- 87 Switch Ideas
- 1.4K Wireless
- 56 Wireless Ideas
- 7.1K Consumer Product
- 312 Service & License
- 506 News and Release
- 97 Security Advisories
- 31 Education Center
- 10 [Campaign] Zyxel Network Detective
- 5.1K FAQ
- 34 Documents
- 89 About Community
- 114 Security Highlight