Guest Device URL filter

Goal:

URL Filter (Adult, Gambling, FileSharing, etc) Guest Devices, Internal Devices without SSL man-in-the-middle decryption

Scenario:

Internal network filters great with current on-prem solution since they trust our network issued cert and CA, but Guest devices do not trust the cert from the FW. Users don't being prompted that the site they are visiting might not be secure.

Question:

From what I've found, perhaps an on-prem device looking at URLs isn't the best solution to achieve this goal. Would a cloud solution achieve this? Essentially I just want to make sure the Nofun police can still filter, block, audit URLs from the Guest network even if the site is over https.

​

​