# CommonName Usage in Certificate for URL Filtering **URL:** \ **Category:** Web Proxy, URL Filter & Update Accelerator\ **Created:** [20 December 2024 09:41 UTC](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338 "2024-12-20T09:41:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![florom](https://community.ipfire.org/user_avatar/community.ipfire.org/florom/32/15508_2.png) [@florom](https://community.ipfire.org/u/florom)\ **Post date:** [20 December 2024 09:41 UTC](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338/1 "2024-12-20T09:41:10Z")
Hello Devs, I heard that other Firewalls use for URL Filtering in https traffic the commonName of the certificate itself which allows Filtering without breaking the https encryption. With the commonName (CN) in the certificate the website can be categorized. Is this a possibilty in IPFire too? I never really got he URL Filtering working and I thought its due to the encyrption and/or allowing https traffic and/or no proxy usage, but this method seems to work with everything of that off. Thank you, great product 🙂 Florom ---
**Author:** ![florom](https://community.ipfire.org/user_avatar/community.ipfire.org/florom/32/15508_2.png) [@florom](https://community.ipfire.org/u/florom)\ **Post date:** [18 January 2025 09:00 UTC](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338/2 "2025-01-18T09:00:05Z")
Hi there, I wonder why this did not get any attention? Christmas or too common topic? At least this I want to know. Thanks. ---
**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\ **Post date:** [18 January 2025 14:39 UTC](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338/3 "2025-01-18T14:39:38Z")
You need to use the proxy in non transparent mode. Then it will filter HTTPS traffic. ---
**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Post date:** [18 January 2025 18:28 UTC](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338/4 "2025-01-18T18:28:59Z")
> [@florom](#): > > I wonder why this did not get any attention? The devs generally don’t have time to look at every post in the forum and once a couple of days are past then the post is gone past. If you are looking to address the devs then you are better off going to the dev mailing list. [https://www.ipfire.org/docs/devel/contact](https://www.ipfire.org/docs/devel/contact) From my perspective, knowing how busy the devs are with both the IPFire work but also their days jobs to be able to pay the bills etc, a better approach would be for a user to submit a patch to the dev mailing list for the function desired. [https://www.ipfire.org/docs/devel/submit-patches](https://www.ipfire.org/docs/devel/submit-patches) This doesn’t guarantee a patch will be accepted but it acts as the starting point for a dialogue with the devs to come up with a solution that fits within the IPFire framework. If the expectation is that the small team of devs will do all the work from a suggestion then it might take some time as all of them are very busy with existing activities. So in that case be prepared to wait until the item works its way down the list. ---
**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\ **Post date:** [18 January 2025 20:02 UTC](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338/5 "2025-01-18T20:02:05Z")
Isn’t CN filtering pretty much the same as DNS filtering except you can have lots of different domains covered by a single CN? It would have the advantage that DoH and other DNS tunnelling wouldn’t affect the CN which appears over HTTP. ---
**Author:** ![pscar13](https://community.ipfire.org/user_avatar/community.ipfire.org/pscar13/32/16558_2.png) [@pscar13](https://community.ipfire.org/u/pscar13)\ **Post date:** [18 January 2025 23:04 UTC](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338/6 "2025-01-18T23:04:03Z")
hi, > [@CommonName Usage in Certificate for URL Filtering](https://community.ipfire.org/t/commonname-usage-in-certificate-for-url-filtering/13338/3): > > You need to use the proxy in non transparent mode. Then it will filter HTTPS traffic. The transparent proxy does not filter HTTPS, you need to enable WPAD. > **[Web Proxy Auto-Discovery Protocol (WPAD) / Proxy Auto-Config (PAC)](https://www.ipfire.org/docs/configuration/network/proxy/extend/wpad)**