Set a calendar reminder 30 days before your GFI license expires. When the license expires, the web filter immediately deactivates.
If the basic checks fail, follow this systematic repair guide.
The web filter uses SSL certificates to talk to GFI’s cloud. If your Kerio server’s clock is off by more than 5 minutes, the SSL handshake fails, and categorization is disabled.
Fix:
If your network connects to the internet via a corporate proxy, Kerio Control must be told to use it. Set a calendar reminder 30 days before your
Go to Configuration → Advanced → Proxy Settings or Web Filter → Upstream Proxy (version dependent).
Enter:
Without this, categorization requests will time out.
Do not start changing settings randomly. Follow this logical sequence. Without this, categorization requests will time out
Even with a valid license, the categorization engine may be disabled. Go to Configuration → Content Filtering → Web Filter.
If the box is already checked, uncheck it, save, then re-check and save again. This forces a reinitialization of the categorization service.
Q1: Can I use Kerio Control without cloud categorization?
Yes, but only with static URL lists, IP-based rules, or by disabling web filtering entirely. Dynamic filtering will not work.
Q2: Does this error affect HTTPS filtering?
Indirectly. HTTPS filtering (SSL inspection) is separate. However, if categorization is disabled, you cannot block HTTPS sites based on category, even if SSL inspection is on. If the box is already checked, uncheck it,
Q3: How long does it take for categorization to re-enable after fixing?
Usually 1–5 minutes. Restart the firewall engine for immediate effect.
Q4: Is there a way to test categorization manually?
Yes. Use Kerio’s test tool (if installed):
/usr/local/kerio/winroute/bin/kwfmgr --test-categorization example.com
Q5: Does the free version of Kerio Control include categorization?
No. The free version (limited to 5 users) does not include cloud categorization. Web filtering will always show as disabled.
Sometimes the service itself is turned off manually or due to a configuration error.