SSL/TLS Deep Inspection on FortiGate

Why inspect encrypted traffic

The majority of web traffic is now TLS-encrypted. Without inspection, threats hidden inside HTTPS flow straight past your security profiles. FortiGate offers two modes:

• Certificate inspection — looks only at the certificate/SNI (which site), not the payload. Lightweight, privacy-preserving, but limited.

• Deep inspection (full SSL inspection) — FortiGate acts as a trusted man-in-the-middle, decrypting, inspecting, then re-encrypting traffic so antivirus, IPS, and application control can see inside.

The certificate trust model

In deep inspection, FortiGate presents its own CA certificate to clients. For this to work without browser warnings, the FortiGate CA must be trusted by endpoints:

• Use the built-in Fortinet_CA_SSL or, better, a CA signed by your enterprise PKI.

• Deploy the CA to clients via group policy / MDM.

config firewall ssl-ssh-profile
    edit "deep-inspection"
        set server-cert-mode re-sign
    next
end

Exceptions and privacy

Some traffic must be exempted from deep inspection for legal, privacy, or technical (certificate-pinning) reasons — banking and healthcare categories, for example. Configure exemptions by category or address so pinned apps keep working.

What it means for you

Deep inspection is what makes the rest of your UTM stack effective against modern encrypted threats. Getting the certificate trust chain right is the difference between full visibility and a flood of browser errors.