A FortiGate administrator enables SSL deep inspection on a policy but users report certificate warnings in their browsers. What is the most appropriate step to resolve this while keeping deep…

Question

Options

• AInstall the FortiGate CA certificate on client devices
• BDisable HTTPS scanning in the policy
• CDisable all security profiles on the policy
• DChange the policy action from ACCEPT to DENY

• A
  93% (26)
• B
  4% (1)
• C
  4% (1)

Explanation

When FortiGate performs SSL deep inspection, it acts as a man-in-the-middle by decrypting, inspecting, and re-encrypting HTTPS traffic - signing re-encrypted packets with its own CA certificate. Browsers don't trust this CA by default, which triggers the warning; installing the FortiGate CA cert on client devices (via GPO, MDM, or manual install) tells browsers to trust it, eliminating the warnings while keeping deep inspection active.

Why the distractors are wrong:

• B - Disabling HTTPS scanning removes the core functionality you're trying to preserve; the goal is to keep deep inspection active.
• C - Disabling security profiles defeats the entire purpose of enabling deep inspection in the first place.
• D - Changing the action to DENY would block all traffic matching the policy, breaking connectivity entirely.

Memory tip: Think of FortiGate as impersonating a trusted notary. If clients don't have its "notary license" (CA cert) in their trusted store, they'll reject its signatures. You're not removing the notary - you're teaching clients to trust it.

No community discussion yet for this question.