SSL Deep Inspection Certificate Warning: Forward Trust CA Not Installed
A FortiGate administrator has configured a firewall policy with SSL deep inspection using a forward trust CA certificate. When users access an HTTPS website with a valid certificate, they still receive a certificate warning. What is the MOST likely reason?
Quick Answer
The answer is that the forward trust CA certificate is not installed on the users’ devices. This is the most likely reason for the certificate warning because SSL deep inspection works by having the FortiGate generate a new certificate on-the-fly for each HTTPS session, signed by its own forward trust CA. If that CA certificate is not trusted on the client machine, the browser will flag the connection as untrusted, even if the original website’s certificate is perfectly valid. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of the SSL inspection handshake and the critical distinction between the server-side certificate and the locally-issued one. A common trap is assuming the warning indicates a problem with the remote website or the FortiGate’s configuration, when in fact the issue is purely client-side trust. Remember the memory tip: “Trust the CA, or see the warning—the client must install the FortiGate’s CA.”
⚠ Common exam trap
Watch out — candidates often confuse certificate inspection with deep inspection, or assume the FortiGate's own certificate is automatically trusted by clients, when in fact the forward trust CA must be explicitly deployed to all user devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The forward trust CA certificate is not installed on the users' devices
When SSL deep inspection is configured, the FortiGate generates a new certificate for each HTTPS session, signed by the forward trust CA. If the forward trust CA certificate is not installed in the trusted root store on the users' devices, the browser will not trust the generated certificate and will display a certificate warning. This is the most common cause of such warnings even when the original website certificate is valid.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator configures SSL deep inspection on a policy using a self-signed CA certificate. Users report that they see a certificate warning in their browsers when accessing HTTPS sites. What is the most effective solution to eliminate these warnings?
hard- A.Use a publicly trusted CA certificate for the FortiGate
- B.Disable deep inspection and use certificate inspection only
- C.Add the websites to the exemption list in the SSL/SSH profile
- ✓ D.Install the FortiGate's CA certificate on all client machines in the trusted root store
Why D: The certificate warning occurs because the browser does not trust the FortiGate's self-signed CA certificate. By installing the FortiGate's CA certificate into the trusted root store on each client machine, the browser will trust certificates signed by that CA, eliminating the warning. This is the standard approach for self-signed CA certificates in SSL deep inspection environments.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.