SSL inspection: certificate vs deep
certificate-inspection · deep-inspection · SSL-SSH profile
how much of an HTTPS session the FortiGate can actually see
The single biggest source of "why isn't web filtering working" tickets. Chosen in the SSL/SSH Inspection profile attached to a policy.
How it is read
Certificate inspection
mode
The FortiGate reads only the unencrypted handshake — the SNI and the server certificate. It can do web filtering by FQDN and block by cert, but cannot see URLs, content, or files. No client trust needed, nothing breaks. Fails against ESNI/ECH and domain-fronting.
Deep inspection (full SSL)
mode
The FortiGate acts as a man-in-the-middle: decrypts, inspects (full URL filtering, AV, DLP, app control), re-encrypts with a certificate it signs. Every client MUST trust the FortiGate CA or you get cert errors everywhere. Exempt categories (banking, health) and pinned apps (Windows Update, many mobile apps) still break — hence the exemption list.