How to Avoid Certificate Errors with Self-Signed Servers in SSL Deep Inspection
An administrator enables deep inspection for HTTPS traffic. Users report that they cannot access some websites because of certificate errors. The administrator wants to override these errors and allow access. What should be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the websites to the 'SSL/SSH exemption' list in the deep inspection profile
In FortiOS, deep inspection can generate certificate errors for sites with self-signed or mismatched certificates. To allow access despite errors, the administrator can add the affected domains to the 'SSL/SSH exemption' list in the deep inspection profile. This exempts those sites from deep inspection, avoiding the certificate error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable certificate verification in the deep inspection profile
Why it's wrong here
Disabling certificate verification in the deep inspection profile makes the FortiGate accept any SSL/TLS server certificate without validating its authenticity or expiry. That removes the security benefit of deep inspection and exposes clients to man-in-the-middle attacks, so it is much broader and riskier than exempting a few trusted sites. The intended way to handle sites that fail inspection is to exempt just those domains, not to disable verification globally.
- ✗
Add the websites to the 'FortiGuard category' allow list
Why it's wrong here
The FortiGuard category allow list is part of the web filter engine, which makes allow/deny decisions based on URL categories after traffic has been decrypted. Deep inspection certificate processing happens earlier, during the TLS handshake, and it determines whether the FortiGate will decrypt at all. Whitelisting a category does not change how the FortiGate validates or intercepts certificates, so it has no effect on certificate errors.
- ✗
Configure the web filter to allow these websites
Why it's wrong here
Configuring the web filter to allow the websites controls whether users can access the sites after deep inspection succeeds, but it does not alter the SSL/TLS inspection behavior. Certificate verification and the decision to decrypt occur before web filtering is consulted, so the FortiGate will still present its own CA-signed certificate and attempt the interception. To avoid certificate errors, the flow must be bypassed at the decryption stage, not at the content policy stage.
- ✓
Add the websites to the 'SSL/SSH exemption' list in the deep inspection profile
Why this is correct
Adding the websites to the SSL/SSH exemption list in the deep inspection profile is the correct method because it instructs the FortiGate to skip decryption for those exact destinations. The FortiGate then forwards the TLS handshake untouched, so the browser sees the original site certificate and no certificate validation error occurs. All other HTTPS traffic continues to be deeply inspected, preserving overall security while solving the compatibility problem.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.