Recently I've been gathering information about OSI Layer-7 firewalls, i.e. firewalls that might block traffic based on the application.
Most of these firewalls have capabilities like "Block Twitter", or "Block Facebook" traffic... which leads me to the following question:
How can these firewalls block such traffic if both Twitter and Facebook are fully TLS encrypted?
I've been trying to theorize this by myself and these are the conclusions I've come to:
It cannot be done with a permanent man-in-the-middle because these certificates are ephimeral and users would be warned each time they try to reach these sites, and they would also need to accept the certificate each time (documentation claim this doesn't happen).
My wild guess is that this "block" action is taken when negotiating the SSL/TLS connection and prior to establishing it. They could get the certificate of the site, see for what sites they are used, and if some of them are (say) Twitter or Facebook, block it?
If none of the above is the right one, what other methods could be used to achieve that?
Note: I'm not talking about a specific brand, I'm just interested on how this technology works without breaking the SSL/TLS chain.