How to Avoid Certificate Errors with Self-Signed Servers in SSL Deep Inspection
A FortiGate administrator is configuring SSL deep inspection for a firewall policy that handles traffic to multiple internal servers. Some servers have self-signed certificates. The administrator wants to avoid certificate errors for users. What configuration is recommended?
Quick Answer
The answer is to add the self-signed server certificates to the FortiGate’s trusted CA store. This configuration is required because during SSL deep inspection, the FortiGate acts as a man-in-the-middle, decrypting and re-encrypting traffic; if it does not trust the origin server’s self-signed certificate, it will generate a certificate error for the end user. On the Fortinet NSE 4 exam, this scenario tests your understanding of how deep inspection differs from certificate inspection—the common trap is choosing to disable deep inspection or switch to certificate-only inspection, which would bypass payload inspection and fail the security objective. Remember that the FortiGate must explicitly trust the server’s certificate, not the user’s browser. A useful memory tip: “Trust the server, not the user” — add the self-signed cert to the FortiGate’s CA store to avoid errors while keeping full inspection active.
⚠ Common exam trap
Many exam-takers think disabling deep inspection or using certificate inspection is simpler, but the correct approach is to trust the self-signed certificates by importing them into the FortiGate's CA store to maintain full inspection without certificate errors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the server certificates to the FortiGate's trusted CA store
Adding the self-signed server certificates to the FortiGate's trusted CA store allows the FortiGate to validate those certificates during SSL deep inspection. This prevents certificate errors for users, as the FortiGate will trust the self-signed certificates and generate a valid signed certificate for the client, avoiding browser warnings.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator enables deep inspection for HTTPS traffic. Users report that they cannot access some websites because of certificate errors. The administrator wants to override these errors and allow access. What should be configured?
hard- A.Disable certificate verification in the deep inspection profile
- B.Add the websites to the 'FortiGuard category' allow list
- C.Configure the web filter to allow these websites
- ✓ D.Add the websites to the 'SSL/SSH exemption' list in the deep inspection profile
Why D: In FortiOS, deep inspection can generate certificate errors for sites with self-signed or mismatched certificates. To allow access despite errors, the administrator can add the affected domains to the 'SSL/SSH exemption' list in the deep inspection profile. This exempts those sites from deep inspection, avoiding the certificate error.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.