A computer implemented method for blocking network connections to network resources of forbidden categories, the method comprising: intercepting a certificate when a protected connection is being established between a client and a server; determining categories of network resources to which a connection of the client is forbidden; determining a category of the intercepted certificate, the determination of the category of the intercepted certificate comprising: determining whether the intercepted certificate is unknown or known, and determining the category of the intercepted certificate based on whether the certificate is known or unknown; extracting attributes from the intercepted certificate; and blocking the network connection when the determined category of the intercepted certificate is a category of the determined categories of the network resources to which the connection of the client is forbidden, or when the intercepted certificate is found to be similar to forbidden certificates, characterized in that: when the intercepted certificate is unknown, the method further comprises: representing known certificates by clusters containing vectors of attributes of the known certificates; representing forbidden certificates by a cluster containing vectors of attributes of the forbidden certificates; transforming the attributes extracted from the intercepted certificate into an N-dimensional vector of the intercepted certificate; determining distances between the N-dimensional vector of the intercepted certificate and each cluster of the clusters containing vectors of attributes of the known certificates, and wherein the intercepted certificate is found as being similar to known certificates of a cluster if: the cluster is a cluster containing the vectors of attributes of the forbidden certificates, and the distance between the N-dimensional vector of the intercepted certificate and a center of the cluster is less than a radius of the cluster, or a measure of proximity between the N-dimensional vector of the intercepted certificate and the center of the cluster is less than a threshold value. intercepting a certificate when a protected connection is being established between a client and a server; determining categories of network resources to which a connection of the client is forbidden; determining a category of the intercepted certificate, the determination of the category of the intercepted certificate comprising: determining whether the intercepted certificate is unknown or known, and determining the category of the intercepted certificate based on whether the certificate is known or unknown; extracting attributes from the intercepted certificate; and blocking the network connection when the determined category of the intercepted certificate is a category of the determined categories of the network resources to which the connection of the client is forbidden, or when the intercepted certificate is found to be similar to forbidden certificates, characterized in that: when the intercepted certificate is unknown, the method further comprises: representing known certificates by clusters containing vectors of attributes of the known certificates; representing forbidden certificates by a cluster containing vectors of attributes of the forbidden certificates; transforming the attributes extracted from the intercepted certificate into an N-dimensional vector of the intercepted certificate; determining distances between the N-dimensional vector of the intercepted certificate and each cluster of the clusters containing vectors of attributes of the known certificates, and wherein the intercepted certificate is found as being similar to known certificates of a cluster if: the cluster is a cluster containing the vectors of attributes of the forbidden certificates, and the distance between the N-dimensional vector of the intercepted certificate and a center of the cluster is less than a radius of the cluster, or a measure of proximity between the N-dimensional vector of the intercepted certificate and the center of the cluster is less than a threshold value. representing known certificates by clusters containing vectors of attributes of the known certificates; representing forbidden certificates by a cluster containing vectors of attributes of the forbidden certificates; transforming the attributes extracted from the intercepted certificate into an N-dimensional vector of the intercepted certificate; determining distances between the N-dimensional vector of the intercepted certificate and each cluster of the clusters containing vectors of attributes of the known certificates, and wherein the intercepted certificate is found as being similar to known certificates of a cluster if: the cluster is a cluster containing the vectors of attributes of the forbidden certificates, and the distance between the N-dimensional vector of the intercepted certificate and a center of the cluster is less than a radius of the cluster, or a measure of proximity between the N-dimensional vector of the intercepted certificate and the center of the cluster is less than a threshold value. the cluster is a cluster containing the vectors of attributes of the forbidden certificates, and the distance between the N-dimensional vector of the intercepted certificate and a center of the cluster is less than a radius of the cluster, or a measure of proximity between the N-dimensional vector of the intercepted certificate and the center of the cluster is less than a threshold value.