topic URL Filtering - TLS 1.3 Website in General Topics

URL Filtering - TLS 1.3 Website

tpmeier — Fri, 04 Jan 2019 13:59:43 GMT

Hi,

I am new to Palo Alto Firewalls and am in the middle of testing some of the functionalities provided. One of which is URL Filtering.

I have been able to clone the default URL Filtering Profile. I then added a website to the blocked list. Then assigned the profile to a security policy. And it worked.

I found this knowledge base article confirming URL for HTTPS is determind by checking certificate:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRZCA0

"For HTTPS traffic, since this protocol is being encrypted, the firewall usually looks at data inside the Server Certificate that is presented to the client during the SSL handshake. In the case of decryption, this traffic will be treated as normal HTTP traffic when it comes to identifying the category."

Why are URLs for TLS 1.3 recognized? With TLS 1.3 (as far as I understand) the certificate itself is not transferred in plain text anymore?

Happy to hear from you guys soon,
Regards Eve

Re: URL Filtering - TLS 1.3 Website

Remo — Fri, 04 Jan 2019 18:32:54 GMT

Hi @tpmeier

The firewall does not only check the certificate in TLS connections for URL filtering - it also (or primary) uses the SNI extension (server name indication) in a TLS handshake. This extension contains the fqdn in cleartext - als in TLS1.3 connections (even though starting with TLS1.3 it is possible to encrypt this value with additional config steps).

That's the reason why URL filtering still works for a lot of websites that use TLS1.3.

Regards,

Remo

Re: URL Filtering - TLS 1.3 Website

RizwanJamil — Sun, 19 Feb 2023 12:39:45 GMT

Vsys_remo is correct. Here are the three relevant points from this kb with title "HOW TO IDENTIFY URL INFORMATION ON SSL TRAFFIC WITHOUT DECRYPTION":

The SNI is used for URL categorization when SSL decryption is not enabled.
If the client does not send the SNI, then the Common Name (CN) which represents the server name protected by the SSL certificate is used for URL categorization.
Putting the hostname of the web server in the allow or block list of a URL filtering profile will essentially accomplish the same goal as using the CN to enforce policy.