I have a friend who owns a coffee shop and he has a public network. He asked me for a way to prevent the customers from visiting any web site that present a potential threat to the admin (websites that has either sexual content or any kind of extremism). How can I block such sites?
What you need is a web filter. This creates the ability to inspect the traffic and filter it depending on the destination.
Note that, unlike the other answer, this does not need any SSL interception since all you are doing is reviewing the IP names and addresses.
Typically, you will use a product that uses dynamically updated block lists, generally grouped so that you can disable access to whole categories such as gambling very easily.
There are many products that will do this at different price points. One example is Sophos UTM though that is most likely overkill for your needs as it is an enterprise tool. Trend and most of the other recognised security vendors all have web filtering tools available.
If you want something quick and dirty, you can also switch your DNS service to use OpenDNS. OpenDNS also provides dynamically updated web filter lists but they work simply by preventing an IP Address lookup so it is possible to bypass the restrictions - generally by users manually setting their own DNS servers.
You can block inappropriate websites using OpenDNS Familyshield service to configure which websites can/cannot be seen on your network
I would suggest using a so called SSL Interception proxy. To get the user to install the CA Root certificate, its possible to use a captive portal, to force the end user to install the CA Root to gain internet access.
This is how to do it: first, you have a portal page. This portal page must use a VALID certificate. This portal page, lets call it captive.yourdomain.tld , have a valid certificate that is issued by a valid CA already in trust.
On this portal page, you have instructions how to download the .cer CA certificate and how to import it in browser.
Now, from captive.yourdomain.tld, you set HSTS with subDomains activated.
The result is a captive portal, that REQUIRES installing a CA root certificate in the browser to gain internet access at all. Since the page is bootstrapped with a real certificate, user will be prevented access (by HSTS no user recourse block page) if the validate.captive.yourdomain.tld fails to validate, which it would if you haven't imported the CA root.
The user does not need to authenticate to the captive portal, it happens automatically provided you have imported the CA root.
Here is a video how it looks: https://www.youtube.com/watch?v=5OXbfnG-hdg (But it can be implemented on any captive portal device tha allows a custom authentication page to be uploaded)
Then when you have done this, you can use any proxy in-between with this SSL interception proxy to filter content by keywords, URL or whatever you see fit.