NSE4 Security Profiles Practice Question
A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?
⚠ Common exam trap
Many exam-takers think using a publicly trusted CA (Option A) is the solution, not realizing that the FortiGate must hold the private key for that CA, which is impractical and insecure; the correct approach is to trust the FortiGate's own CA internally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the FortiGate's CA certificate on all client machines in the trusted root store
The certificate warning occurs because the browser does not trust the FortiGate's self-signed CA certificate. By installing the FortiGate's CA certificate into the trusted root store on each client machine, the browser will trust certificates signed by that CA, eliminating the warning. This is the standard approach for self-signed CA certificates in SSL deep inspection environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a publicly trusted CA certificate for the FortiGate
Why it's wrong here
A publicly trusted CA cannot issue the on-demand certificates that deep inspection requires. When a client connects to any HTTPS site, the FortiGate must instantly generate a certificate for that specific domain, so it must act as its own CA. Using a public CA would require domain validation for every site before inspection, which is impractical and not supported. Therefore, this does not solve the root issue of establishing a trusted internal CA.
- ✗
Disable deep inspection and use certificate inspection only
Why it's wrong here
Certificate inspection only examines the server certificate header without decrypting the payload, so it cannot scan for malware or data leaks. Since no forged certificate is presented, clients would not see warnings, but this completely abandons the security visibility that deep inspection is meant to provide. The administrator configured deep inspection, so falling back to certificate inspection defeats the purpose and is not a valid solution.
- ✗
Add the websites to the exemption list in the SSL/SSH profile
Why it's wrong here
Adding websites to the exemption list in the SSL/SSH profile selectively disables deep inspection for those domains, typically because they use certificate pinning or require a real server certificate. This only suppresses warnings for the exempted sites; all other HTTPS traffic is still decrypted using the FortiGate's CA, so warnings persist. It is a targeted workaround, not a resolution for the widespread untrusted CA problem.
- ✓
Install the FortiGate's CA certificate on all client machines in the trusted root store
Why this is correct
Installing the FortiGate's CA certificate into the trusted root store of every client establishes the FortiGate as a trusted certificate authority within the organization. When the FortiGate generates a per-session certificate signed by this CA, the client's browser accepts it without warnings because the CA is in its trust store. This directly addresses the root cause of the warning and is the recommended enterprise deployment practice for deep inspection.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.