Which of the following statements are true about Man-in-the-middle SSL Content Inspection? (Choose three.)

The FortiGate device generates *new* certificates for the client, signed by its own CA certificate, rather than directly re-signing the original server certificates.

In Man-in-the-middle SSL Content Inspection, the FortiGate device essentially functions as a 'sub-CA' by dynamically generating and signing new certificates for the client for each SSL connection it inspects, using its own CA certificate.

For Man-in-the-middle SSL inspection, the FortiGate requires its own 'SSL Inspection CA' certificate (often referred to as a local service certificate) to be trusted by client browsers, which it uses to dynamically sign certificates presented to clients.

This statement is too general and merely reiterates that the FortiGate performs man-in-the-middle inspection, failing to describe specific operational details as requested by the question.

The 'SSL Proxy certificate' is the FortiGate's CA certificate used to sign dynamically generated server certificates. For trusted operation without client warnings, this CA certificate must be trusted by clients, often by being issued by an internal CA or, less commonly, a public CA, or by manual installation.