When using Smart Content Filter, you may notice a certificate error similar to the images below when attempting to visit a blocked domain over HTTPS:
Why Does this Happen?
If a domain is blocked, Smart Content Filter responds with an IP address of our block page server. If the blocked domain was accessed via HTTPS, the browser asks for the SSL Certificate for the domain, but receives a certificate for blocked.fibretel.ca instead. The browser recognizes this as a mismatch and thus displays an error. This effect is common among all content and security filtering solutions and is a consequence of HTTPS.
How Can it be Fixed?
If you manage the endpoints of the site. There are several options to easily deploy the SSL certificate. This is highly recommended because it will allow your users to see the notification that a site is being blocked, instead of thinking that there is a problem with their browser or computer. Our Installing SSL Certificates article has several options to install the certificate.
If you have a site with unmanaged endpoints (Guest WiFi etc) you will likely not have the opportunity to deploy the certificate unless providing instructions and the certificate to their user base through a captive portal or provide education in some other manner. However, this SSL certificate is optional to provide the “You are blocked” notification - Blocking is active regardless of if the certificate is installed or not.