[mckoss]

You can't selectively block content on an SSL connection w/o having a back door to the encryption keys used to secure the connection. A man in the middle attack would be detectable unless the root certificates were compromised.

[flyinghamster]

That's where CNNIC comes in. All they need to do is issue their own fake certificate for (insert blocked site here).

[imron]

Isn't it wonderful to have your own certificate authority.