A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When…

Application control's primary role is to identify and control applications, not directly decrypt SSL/TLS traffic for antivirus scanning.

For FortiGate to inspect encrypted HTTPS traffic for viruses, it must be able to decrypt the traffic. While SSL certificate inspection is enabled, the specific SSL/SSH Inspection profile must be configured for 'deep inspection' (full SSL inspection) to perform this decryption and allow security profiles like antivirus to inspect the content. If it's configured for 'certificate inspection' or 'no inspection,' the encrypted content remains uninspected.

The antivirus profile is correctly configured as it detects the virus over HTTP, indicating the profile itself is functional, but it cannot apply to uninspected HTTPS traffic.

Antivirus definitions are up to date since the EICAR file is detected and blocked over HTTP, proving the definitions are current and effective when traffic is visible.