Recently I've been gathering information about OSI Layer-7 firewalls, i.e. firewalls that might block traffic based on the application.

Most of these firewalls have capabilities like "Block Twitter", or "Block Facebook" traffic... which leads me to the following question:

How can these firewalls block such traffic if both Twitter and Facebook are fully TLS encrypted?

I've been trying to theorize this by myself and these are the conclusions I've come to:

  • It cannot be done with a permanent man-in-the-middle because these certificates are ephimeral and users would be warned each time they try to reach these sites, and they would also need to accept the certificate each time (documentation claim this doesn't happen).

  • My wild guess is that this "block" action is taken when negotiating the SSL/TLS connection and prior to establishing it. They could get the certificate of the site, see for what sites they are used, and if some of them are (say) Twitter or Facebook, block it?

If none of the above is the right one, what other methods could be used to achieve that?

Note: I'm not talking about a specific brand, I'm just interested on how this technology works without breaking the SSL/TLS chain.


You might need to define "application" in this context. If you're only talking about blocking certain big name web sites that happen to have mobile apps as custom UI (like your examples of Twitter and Facebook), then a firewall could do several things:

  1. Block (or answer incorrectly) DNS lookups for those sites or their associated CDNs (the biggest sites usually have their own CDNs).
  2. Block traffic to the known IP addresses of those sites and their known CDN nodes (edge servers).
  3. Watch the start of all TLS negotiations and cut off any connections where the server cert contains the domain name to be blocked, or any of the known associated domain names (CDN domain names).
| improve this answer | |
  • Right, I was just talking about those certain big web sites, as per what I could see many of them offer the possibility to block them. If I understood it correctly, if they used the first approach you detailed, any DNS lookup to those blocked sites would fail as well, not just HTTP(S) requests, right? – nKn Jan 19 '17 at 18:26
  • 1
    To add to this answer: all current browsers include the target hostname in the ClientHello (start of TLS handshake) because of Server Name Indication. This way already the request can be blocked and there is no need to check the certificate returned by the server. – Steffen Ullrich Jan 19 '17 at 18:56

Of course enterprise firewall may filter "big players" by (cdn or server) IP address but that's definitely not Layer 7.

However, MITM attack on SSL is possible if somebody installs the proxy (root CA) certificate on your browser. After that, layer 7 inspection can be done on clear text.

It's not particularly challenging to install (even remotely) the required trusted certificate in your browser in a controlled enterprise environment. With the certificate in place, the firewall act as a proxy opening (a new external) SSL connection in your name to the website, gets the data and after inspection forwards it to you in an another ssl session. It creates a fake certificate for you which mimics the original but signed by the company own trusted ca. Normal user wont notice anything. No warning, no pop ups. Everything is fine.

Of course, if you are using your own device not controlled by the company you will immediately see the cheat. But, of course, you are not allowed to use your own device at the company's network. Now it's clear why. :)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.