How does a country block/censor an encrypted website (HTTPS)?

Question

Given that Site X uses HTTPS, how can it be blocked by a country?

My browser reads: 128-bit encryption | ECDHE_RSA as key exchange.

I say it's blocked since when I use Tor, it works fine.

One important thing to point out is that it's not blocked in the typical sense we are used to see, which clearly shows a page that says it's blocked, instead, site X is blocked in a way that my browser just doesn't load the page and displays the error:

This webpage is not available, Error code: ERR_CONNECTION_RESET

for the HTTPS version, and that regular "page is blocked" page when requesting the HTTP version.

Note that no other HTTPS sites are blocked! Just this one! I assume this is evidence that excludes port blocking and protocol blocking. However, it leaves DPI; but there are other HTTP-blocked websites which have the HTTPS version still working! If they can DPI-block site X, why can't they block the other HTTPS sites the same way?

Answer 1

TL;DR: TLS only secures the content of a message. Not the metadata.

When communicating over the clear net, it's important to remember that there are some portions of a given communication that cannot be secured using standard technologies. Unless you use something like TOR, your ISP will be able to determine who you're talking to even if you're using TLS.

To use an analogy, imagine sending an envelope via the postal service. The contents of the envelope are completely inaccessible to anyone other than the recipient. Even if a postman were to somehow view the contents, they wouldn't be able to comprehend it (Perhaps you ran it through a Caesar cipher first? Hehe).

However, in order to have the postal service send it to the correct address, the outside of the envelope must be marked with a plainly readable representation of the destination address. If the postal service didn't want anyone to be able to send letters to "Joe Schmoe, 123 Fake street," then they could just not deliver any letters with that address.

Since the postal service can't read the contents of the message, they have no way to identify the intent of the letter. The only information that they have is the fact that the intended recipient is Joe Schmoe. They can't screen only the letters that they deem to be malicious; it's all or nothing.

Similarly, the IP protocol (the routing protocol that TCP runs on top of) has plainly marked "sender" and "receiver" fields. TLS cannot encrypt this for two reasons:

• TLS runs on top of TCP/IP, and thus cannot modify parts of the packets that belong to those protocols.
• If the IP section was encrypted, then the carrier service (ISP routers) would not be able to identify where the packets need to go to.

The firewall that your ISP or country is forcing all of your traffic through cannot inspect TLS traffic. They only know the metadata supplied by the TCP/IP protocol. They have also deemed that the site you want to access is more bad than good, so they drop all of the traffic to and from the site regardless of the contents.

There is a method to secure even the metadata of online communications, but it is slow and not very scalable. TOR hidden services are one attempt at implementing this. Of course, hidden services only work within the TOR network, which can only be accessed by first connecting to a machine over the clear net. This means that the ISP or firewall still knows that you're proxying your data through the onion. No matter how you try, you will always leak some metadata. If they wanted to, they could reset all connections to TOR nodes in addition to the site they're currently blocking.

If you are trying to establish a direct connection to a specific IP through a firewall, and the firewall has explicit rules to kill any traffic to or from that given IP, then connecting to that IP directly will always be fruitless. You will have to connect to it indirectly, either through TOR, a VPN, or some other proxy service.

Answer 2

Many government web filters are implemented through DNS filtering.

In order to connect to https://www.example.com, your browser first connects to the DNS server of your internet service provider and asks for the IP address of www.example.com. It then builds an encrypted connection to the IP it gets. So the government instructs the ISPs to configure their DNS servers to return no or a fake IP address for the websites they want to block.

To test this, you could configure your network settings to use a different DNS server, like Google's 8.8.8.8. How to do this depends on your operating system, but a guide should be easy to find.

Another method of web filtering is by IP address itself. The ISPs just configure their firewalls to blocks all traffic to the IP address of example.com. Such a filter is harder to circumvent than a DNS filter, but causes a lot more collateral damage. Large web hosters often host thousands or even millions of completely unrelated websites on the same IP address. When ISPs block by IP, they can't block a specific site without also blocking all the others which share the IP.

Answer 3

When you connect to an HTTPS website, the hostname of the website you are connecting to is transmitted over the network in cleartext as part of the TLS handshake. The server's certificate always contains the hostname, because that's how the server authenticates itself to the client: "I am the server that is authorized to serve content for www.foo.example, according to Jim-Bob's Bait Shop and Certificate Authority." Modern browsers¹ also send the hostname in cleartext from the client to the server, in the "Server Name Indication" message which makes it possible to host many HTTPS websites on one IPv4 address.

This is necessary because of the way the math of setting up a secure channel works. Basically, the server has to make a cryptographically unforgeable assertion of its hostname (and some other stuff, most importantly its "public key"), in cleartext, before the process of "key agreement" begins, or else the client cannot be sure that there is no man in the middle intercepting communications.

But the downside is, a "deep packet inspection" firewall can learn that you are trying to connect to a specific website, and block access (e.g. by forging TCP RST packets) even though it couldn't have eavesdropped on the content of your communications with that site, and even if you never reveal the hostname of the site you want to communicate with in any other way.

¹ in this case, "everything you are likely to encounter nowadays, with the glaring exceptions of IE on Windows XP, and the stock Android browser prior to 3.0; unfortunately, both of those are more common than we'd like".

Answer 4

HTTPS does not and cannot hide the IP and hostname of a website or the fact that you're connecting to it. It only encrypts the traffic sent over that connection once it is established.

Given that, it is trivial for someone controlling the line to terminate any connections for a particular site. What HTTPS (hopefully) prevents them from doing is monitoring or modifying the information exchanged with the site, but the fact that you're connecting to it is always visible.

Answer 5

Institutions and companies [eg. hotspot providers] generally deal with this in two ways:

• Instructing DNS servers to point at other IPs: this is a weak obstacle, since technically savvy users can easily change their DNS service, and used when it's not really important to block a site. I believe this is what, for example, the Italian government does: the national ISPs are asked to change their DNS servers so that requests to banned site are instead redirected to a government-hosted page.
• Blocking connections on an IP basis, rather than on a domain basis: this normally requires a transparent proxy (especially used by hotspot providers and such) or a firewall with deep packet inspection (eg. the Chinese firewall). To prevent the user from connecting to banned IPs, a few techniques are then used - among them, injecting TCP reset packets, redirecting packets, or simply dropping them.

Answer 6

It is possible the target site itself is preventing you from accessing it from the source IP range in question.

I know firsthand of many large organisations who block countries not for any other reason than to minimise exposure to hackers coming from that region.

Answer 7

My ISP can block access to some site even with DOH applied. Without DOH, while accessing blocked site browser while redirect to ISP page. With DOH when i access browser says "SSL_ERROR_BAD_CERT_DOMAIN". So i open cerificate button and this certificate is belong to ISP. Thats mean ISP block site via injecting ssl cert