Quick Answer

The answer is to add the self-signed server certificates to the FortiGate’s trusted CA store. This configuration is required because during SSL deep inspection, the FortiGate acts as a man-in-the-middle, decrypting and re-encrypting traffic; if it does not trust the origin server’s self-signed certificate, it will generate a certificate error for the end user. On the Fortinet NSE 4 exam, this scenario tests your understanding of how deep inspection differs from certificate inspection—the common trap is choosing to disable deep inspection or switch to certificate-only inspection, which would bypass payload inspection and fail the security objective. Remember that the FortiGate must explicitly trust the server’s certificate, not the user’s browser. A useful memory tip: “Trust the server, not the user” — add the self-signed cert to the FortiGate’s CA store to avoid errors while keeping full inspection active.