FCP_FGT_AD-7.6 · Question #48
A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this…
The correct answer is C. The browser does not recognize the certificate in use as signed by a trusted CA. The certificate warning errors occur because the SSL inspection profile is configured to use a private CA certificate that is not recognized by the browser as being signed by a trusted CA. For the browser to trust the FortiGate's re-signed certificates, the CA certificate used…
Question
A network administrator has configured an SSL/SSH inspection profile defined for full SSL inspection and set with a private CA certificate. The firewall policy that allows the traffic uses this profile for SSL inspection and performs web filtering. When visiting any HTTPS websites, the browser reports certificate warning errors. What is the reason for the certificate warning errors?
Options
- AThe SSL cipher compliance option is not enabled on the SSL inspection profile. This setting is
- BThe certificate used by FortiGate for SSL inspection does not contain the required certificate
- CThe browser does not recognize the certificate in use as signed by a trusted CA.
- DWith full SSL inspection it is not possible to avoid certificate warning errors at the browser level.
How the community answered
(27 responses)- A7% (2)
- B4% (1)
- C85% (23)
- D4% (1)
Explanation
The certificate warning errors occur because the SSL inspection profile is configured to use a private CA certificate that is not recognized by the browser as being signed by a trusted CA. For the browser to trust the FortiGate's re-signed certificates, the CA certificate used by FortiGate for SSL inspection must be installed in the browser's trusted certificate store. Until the browser recognizes the certificate authority (CA) as trusted, it will continue to display warning errors when accessing HTTPS websites.
Topics
Community Discussion
No community discussion yet for this question.