0

Is it realistic that certain countries like China, Iran, North Korea etc. block your website because it is using SSL?

I realized for my own website that whenever I switch to https, why website can't be opened and falls into infinite loading. I am not sure if it's me or them because the rest of the world can open my site with ssl enabled.

Last but not least, is there any solution to use SSL and not being blocked?

|improve this question
  • North Korea doesn't "block" sites. They have their own intranet. – forest Dec 22 '18 at 12:13
  • @forest: Wikipedia provides a slightly different perspective: while heavily restricted it is actually possible to access internet from North Korea. – Steffen Ullrich Dec 22 '18 at 12:17
  • @SteffenUllrich It's true for tourists, but most civilians are not allowed to access it. – forest Dec 22 '18 at 12:41
2

Countries like China, Iran or North Korea are known for their strict control of the internet. The ISP are controlled by the state and techniques like deep packet inspection are used to control what gets transferred. With TLS only the meta information like domain and target IP address are visible and traffic control can only be done based on this. While thus the actual payload is protected it also means that the chance of overblocking is higher since thed ISP cannot be sure that they content of the site if harmless from the perspective of the government and because of this might block when in doubt.

Last but not least, is there any solution to use SSL and not being blocked?

It is unknown why your specific site is blocked. It might be because the domain name suggests illegal content. It might be because the IP address is shared with other sites which are blocked because of their content. It might be because you use a CDN which supports domain fronting to bypass censorship. It might be because your site is too small to be considered for explicit white-listing and since the actual content is unknown it is blocked to be on the safe site. As long as you don't know why the site is blocked you likely cannot adapt your hosting so that it does not get blocked anymore.

|improve this answer
  • You correctly mentioned deep package inspection. Since a gov can control all inbound and outbound connections they can also control all outside SSL certificates. IIRC the great wall of china performs MitM and thus has no need to block pages just because of SSL. Just like many company firewalls perform automatic MitM in order to protect the company. – BlueWizard Dec 23 '18 at 20:53
  • @BlueWizard: you can do only active MitM to decrypt connection if you can create fake certificates which are trusted by the clients. This means that all clients behind the GFW would need to trust a CA used to create such fake certificates or they would get a message about untrusted certificates. As far as I know no such active MitM is done in China and thus the traffic can not be decrypted. – Steffen Ullrich Dec 23 '18 at 21:40
  • Your computer trusts these certificates because it was delivered with them. Govs can regulate their market and e. g. only sell devices with theee certs on them. I cannot tell you the specifics since I don't know about them. How the US and China censor their internet is state secret. – BlueWizard Dec 25 '18 at 12:01
  • @BlueWizard: China is not a closed country where nobody can go into and nobody can get out. There is actually research about the GFW. – Steffen Ullrich Dec 25 '18 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.