Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?
Current browsers all do SNI (Server Name Indication) to make it possible to setup different hostnames on the same IP but with different certificates. To make this work the hostname of the target server is included in clear in the initial handshake packet from the client (ClientHello).
By selectively blocking the ClientHello if it contains specific strings inside the SNI extension a firewall could block specific SSL sites, even without affecting other SSL sites behind the same IP. On less capable firewalls (without deeper inspection) you could simply have broader rules to block access to specific IPs.
Because this is SSL and the firewall has no access to the real certificate it cannot send the client a proper error page, so the client just gets strange error message inside the browser because the connection was either reset or it times out, depending on how the firewalls handles the blocking.
Technically, an ISP can block any traffic since they are your path out to the rest of the Internet. They can block any ports, websites, etc.
If you are asking if they can downgrade a site you request with HTTPS to regular HTTP, it possible they could serve you such a page. But it would not appears as HTTPS, you would see the URL as HTTP and would see no lock icon, etc. At the packet level, HTTPS and HTTP look different and provide different information.
What an ISP could do
- As the network operator, the ISP could block all traffic to/from some IP addresses for port 443, which is the standard TCP port used for HTTPS. That could be a simple firewall rule. By "block", I mean preventing the TCP connection from being established at all. (Sending back a denial page over HTTPS is quite a bit more challenging — in theory, not possible.)
- If you request
http://example.com/and the server would normally send back an HTTP redirect telling your browser to go to
https://example.com/instead, the ISP could intercept that redirect response.
What an ISP cannot do
Let's assume that the ISP is unable to crack or otherwise work around the cryptography.
- The ISP cannot distinguish between a request to
https://example.com/some/objectionable/location, and therefore cannot selectively block URLs within one website.
- The ISP cannot distinguish between
https://virtualhost2.example.com/, if both virtual hosts are hosted on the same IP address, and they share a wildcard SSL certificate. However, DNS can be spoofed to make this happen — see below.
- If the user obliviously dismisses all SSL certificate mismatch warnings, then that defeats all man-in-the-middle protection that SSL normally provides.
- If the user's browser recognizes a corrupt or compromised Certificate Authority as authoritative, then the ISP could also take advantage of that misplaced trust to decrypt all HTTPS traffic as if it were unencrypted.
- The ISP runs a DNS server, and chances are that you use their DNS server. Their DNS server could be configured to return spoofed responses, such that
encrypted.google.commaps to an IP address that they block.