topic Re: HTTPS response page in General Topics

HTTPS response page

Jafar_Hussain — Sun, 28 Mar 2021 12:27:16 GMT

Dears,

I have created one custom response page(including image) that is for application block and URL block.

example:- If someone wants to access a restricted URL or application the page should be displayed on the customer screen.

I can see, once I apply the custom response page in the URL block page and application block page. then access the HTTP traffic the page display was showing properly, however, while accessing the HTTPS site not able to get the response page.

I have applied the SSL forward proxy decryption. and the traffic decrypted correctly.

Can anyone help me to achieve this?

Re: HTTPS response page

nikoolayy1 — Sun, 28 Mar 2021 12:47:42 GMT

Have you checked this article (read it carefully)?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFKCA0

Re: HTTPS response page

Jafar_Hussain — Sun, 28 Mar 2021 13:19:47 GMT

@nikoolayy1

I believe this article for. to get the response page without SSL decryption. but in my case, the decryption already applied.

Re: HTTPS response page

nikoolayy1 — Sun, 28 Mar 2021 13:32:03 GMT

Have you tested with:

set deviceconfig setting ssl-decrypt url-proxy yes

I am wondering if this will work without fully decrypting the traffic. Also you have added the SSL Trust certficate to the client workstation ?

Also did you test with the default page if client sees the page?

Re: HTTPS response page

Jafar_Hussain — Sun, 28 Mar 2021 13:40:45 GMT

@nikoolayy1

yes, the certificate is installed in client machine.

I checked the default page for HTTP and https that is working fine.

However, for the custom page, the only HTTP website showing the page. while accessing HTTPS not able to get the custom response page.

Re: HTTPS response page

nikoolayy1 — Sun, 28 Mar 2021 14:44:23 GMT

Use tcpdump or Fiddler or HTTPWatch. Maybe the page is returned to the client but the web blowser does not like it for the ssl traffic as new blowsers have such protections (you may test with curl as it will not have such protection and it will display the response page ).

Can you share the custom page if you see that it is not send at all by the Firewall to workstation and just the workstation is not displaying?

Re: HTTPS response page

Jafar_Hussain — Tue, 30 Mar 2021 12:05:04 GMT

@nikoolayy1

I took the capture from the fiddler and found the below error:-

I Don't know why i am getting the connection refuse error. because this same is working with HTTP as well.

Re: HTTPS response page

nikoolayy1 — Tue, 30 Mar 2021 14:41:42 GMT

Is it possible if your custom web page uses custom elements like images etc. not hosted on the Palo Alto firewall itself then the source server that actually hosts the content to be listening to only http on port 80 and not on https 443 ? Many new web blowsers will not agree the main web page that is using SSL to have elements that need plain text http as I see that the web blowser tries https to get an element and it fails but maybe the source server for that elements listens only on http and this is why for HTTP the page works.

Also it is possible for the source server url/ip address of that element that breaks the custom page to not be in the decryption rule of the Palo Alto decryption policy ?

Edit :

I also see you have CONNECT header, is there any proxy between the client and the Palo Alto and the source server of the element ? As the proxy will need to be checked as well if it blocks for some reason https elements of the custom page?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT

Re: HTTPS response page

Jafar_Hussain — Wed, 31 Mar 2021 07:46:56 GMT

@nikoolayy1

There is no proxy.

Re: HTTPS response page

Chacko42 — Wed, 31 Mar 2021 13:43:42 GMT

Hi @Jafar_Hussain,

I would recommend to go back to the default page, to test, if the mechanism is still working.

For integrating images, you can use base64 encoded pictures inside an <img> tag.

With that you can slowly move forward, modify your page and see, when the page isn't shown further.

Re: HTTPS response page

Jafar_Hussain — Thu, 01 Apr 2021 06:49:28 GMT

@Chacko42 @nikoolayy1

I modify to the default page and add an image to refer to these documents:-

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/url-filtering-concepts/url-filtering-response-pages.html

then i am getting the below block page that is expected.

but the custom page that is created by my team is not working.

Re: HTTPS response page

nikoolayy1 — Thu, 01 Apr 2021 07:20:11 GMT

We mentioned this that you need to check if the custom page for example uses img tag that gets the image from a server URI, where HTTP is allowed but HTTPS is not allowed by the server or the firewall or other security policy. I think you need to check this with your team that made the custom page.

Use F12 devtools or HTTPWatch or Fiddler to check the code for the response page as I think the Palo Alto or web blowser automatically change for example:

As it was said better host images and so on things on the Palo Alto firewall than making the user to connect to a server for the image of the custom page and as you see you will not have such issues.

Re: HTTPS response page

nikoolayy1 — Tue, 06 Apr 2021 22:28:58 GMT

Any update on this and if you managed to resolve it?

Re: HTTPS response page

Jafar_Hussain — Thu, 08 Apr 2021 10:49:40 GMT

@nikoolayy1

Nope, our server team is checking.

Re: HTTPS response page

HolgerKrause — Wed, 21 Jul 2021 13:01:55 GMT

Have you found a solution? We are facing the same issue here.

We decrypt all traffic. The response page works fine for http but for websites with ssl the browser identifies an unsecure connection although we have a valid certificate installed. I tried already all the ideas mentioned before, but it is still not working.

The browser shows redirection issues. For ebay.de the response page starts with: 'https://2.18.234.244:6081/php/urladmin.php?args=AAAAaQAAABBAJiCETo.....' .

Re: HTTPS response page

nikoolayy1 — Mon, 09 Aug 2021 12:43:44 GMT

Maybe you have ssl certificate issues as the hostname is 2.18.234.244 as this should match the CN and the CA could be self signed and not public? Also on the firewall have you allowed port 6081 for ssl/web-blowsing by creating a custom service?

Re: HTTPS response page

Remo — Mon, 09 Aug 2021 13:06:28 GMT

@HolgerKrause Looks like there are also authentication policy rules involved in this. This website on port 6081 belongs to captive portal and not to a response page for a blocked website or application

Re: HTTPS response page

Sofiane_Akmoune — Mon, 13 Oct 2025 11:02:48 GMT

Hello, I have the same problem, have you found a solution ?.