Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?

  • they can do everything...... – dev.meghraj Aug 29 '14 at 5:42

Current browsers all do SNI (Server Name Indication) to make it possible to setup different hostnames on the same IP but with different certificates. To make this work the hostname of the target server is included in clear in the initial handshake packet from the client (ClientHello).

By selectively blocking the ClientHello if it contains specific strings inside the SNI extension a firewall could block specific SSL sites, even without affecting other SSL sites behind the same IP. On less capable firewalls (without deeper inspection) you could simply have broader rules to block access to specific IPs.

Because this is SSL and the firewall has no access to the real certificate it cannot send the client a proper error page, so the client just gets strange error message inside the browser because the connection was either reset or it times out, depending on how the firewalls handles the blocking.


Technically, an ISP can block any traffic since they are your path out to the rest of the Internet. They can block any ports, websites, etc.

If you are asking if they can downgrade a site you request with HTTPS to regular HTTP, it possible they could serve you such a page. But it would not appears as HTTPS, you would see the URL as HTTP and would see no lock icon, etc. At the packet level, HTTPS and HTTP look different and provide different information.

  • This means ISP can block https for facebook only , and see my facebook traffic. Isn't it ? – rintec Aug 28 '14 at 19:43
  • Does this mean ISP can block TLS encryption as well ? You may be in position to answer this security.stackexchange.com/questions/66342/… – rintec Aug 28 '14 at 19:47
  • 1
    Not without you knowing its blocked. If they "blocked" it and you went to https://facebook.com you would get a 404. If they redirected from https://facebook.com to http://facebook.com your browser would not tell you its still HTTPS. – Eric G Aug 28 '14 at 19:47
  • 7
    "If they redirected from facebook.com to facebook.com your browse..." They can't do that. An https redirect has to come from the site you're trying to reach, which they can't impersonate (unless they have you install something that lets them do so). – David Schwartz Aug 28 '14 at 21:50
  • 1
    @EricG you won't get a 404 as that requires an actual request being made which won't happen is https is blocked, instead you get a "server won't respond" error – ratchet freak Aug 28 '14 at 23:49

What an ISP could do

  • As the network operator, the ISP could block all traffic to/from some IP addresses for port 443, which is the standard TCP port used for HTTPS. That could be a simple firewall rule. By "block", I mean preventing the TCP connection from being established at all. (Sending back a denial page over HTTPS is quite a bit more challenging — in theory, not possible.)
  • If you request http://example.com/ and the server would normally send back an HTTP redirect telling your browser to go to https://example.com/ instead, the ISP could intercept that redirect response.

What an ISP cannot do

Let's assume that the ISP is unable to crack or otherwise work around the cryptography.

  • The ISP cannot distinguish between a request to https://example.com/some/permissible/location and https://example.com/some/objectionable/location, and therefore cannot selectively block URLs within one website.
  • The ISP cannot distinguish between https://virtualhost1.example.com/ and https://virtualhost2.example.com/, if both virtual hosts are hosted on the same IP address, and they share a wildcard SSL certificate. However, DNS can be spoofed to make this happen — see below.


  • If the user obliviously dismisses all SSL certificate mismatch warnings, then that defeats all man-in-the-middle protection that SSL normally provides.
  • If the user's browser recognizes a corrupt or compromised Certificate Authority as authoritative, then the ISP could also take advantage of that misplaced trust to decrypt all HTTPS traffic as if it were unencrypted.
  • The ISP runs a DNS server, and chances are that you use their DNS server. Their DNS server could be configured to return spoofed responses, such that virtualhost2.example.com or encrypted.google.com maps to an IP address that they block.
  • Good answer but please consider SNI as per Steffen Ullrich's answer. In this case, the server name is sent in plaintext which could let a third party differentiate between hosts on the same IP. – David Houde Aug 29 '14 at 1:30

Yes, they can. For example, https connections to Google are blocked in China while user can access other websites via https, such as Bing.

Not the answer you're looking for? Browse other questions tagged or ask your own question.