> Source: [sk176823](https://support.checkpoint.com/results/sk/sk176823)

# sk176823 - Legitimate site is blocked for "Suspicious Content" - URL Filtering debug shows CN instead of IP address

| Property | Value |
|----------|-------|
| Solution ID | sk176823 |
| Date Created | 2021-12-13 |
| Last Modified | 2021-12-15 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- * URL Filtering blocks traffic from a legitimate website as "suspicious content". Users usually access the website with no issues.
* URL Filtering kernel debug shows the Common Name (CN) instead of the IP address for the problematic website:   
  `... DATE TIME [cpu_20];[fw4_31];1:{policy,urlf_ssl} appi_rad_uf_cmi_handler_match_cb: call appi_user_cmi_handler_handle_url() with cn='10.10.10.10' (12); `   
  `... DATE TIME [cpu_20];[fw4_31];1:{urlf_ssl} appi_user_cmi_handler_handle_url: url_https_normalized = 'https://10.10.10.10' (20);`

## Cause

The problematic website recently updated its certificate. During the update, the website had a problem that caused its Common Name (CN) to appear instead of its IP Address. The Security Gateway cached the website's certificate while the website was experiencing the update issue. URL Filtering sees that the website's certificate is incorrect and then blocks the website.  

By default, the URL Filtering kernel cache times out after 24 hours. However, if users frequently visit the site then the certificate cache stays current and does not time out.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content