Certificate Inspection vs Deep Inspection in FortiGate SSL Inspection
A FortiGate is configured with SSL deep inspection using a locally generated CA certificate. A user reports that they cannot access https://www.example.com and receive a certificate error. The administrator checks the firewall policy and sees that the SSL inspection profile is set to 'certificate-inspection' instead of 'deep-inspection'. What is the MOST likely effect?
Quick Answer
The answer is that the certificate error is unrelated to the SSL inspection profile, because certificate inspection does not decrypt traffic. When a FortiGate is set to certificate-inspection, it only validates the server certificate’s chain and expiration without performing any decryption, so the original server certificate is passed directly to the client. In contrast, deep inspection would decrypt the traffic and re-encrypt it using a locally generated CA certificate, which can cause certificate errors if the client does not trust that CA. On the Fortinet NSE 4 exam, this distinction tests your understanding that certificate inspection is a lightweight validation method, while deep inspection is a full man-in-the-middle decryption. A common trap is assuming any SSL error must come from deep inspection, but here the profile is explicitly set to certificate-inspection, meaning the error originates from the server or client side. Memory tip: “Certificate checks, Deep decrypts—if the cert error persists, check the source, not the FortiGate’s tricks.”
⚠ Common exam trap
Watch out — candidates often confuse 'certificate-inspection' with 'deep-inspection', assuming that any SSL inspection profile decrypts traffic, leading them to incorrectly select option A or D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.
When the SSL inspection profile is set to 'certificate-inspection', the FortiGate does not decrypt the traffic; it only checks the certificate's validity (e.g., expiry, revocation). Therefore, the original server certificate from www.example.com is passed directly to the client. Since the client receives the actual server certificate (which is likely valid), the reported certificate error is unrelated to the FortiGate's configuration. Option B correctly identifies that the error is not caused by the FortiGate's inspection profile.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate decrypts the traffic but does not re-sign, causing mismatch errors.
Why it's wrong here
Certificate-inspection does not decrypt traffic.
- ✓
The FortiGate does not decrypt the traffic, so the original server certificate is presented to the client, which may be valid; the error is unrelated.
Why this is correct
Certificate-inspection mode only checks the certificate chain; it does not re-sign. The client sees the original server certificate. If that certificate is valid, there should be no error. The issue likely stems from a different problem.
- ✗
The FortiGate blocks the connection because certificate-inspection cannot handle deep inspection profiles.
Why it's wrong here
Certificate-inspection works with SSL profiles, but the error is not caused by this mismatch.
- ✗
The user will see a warning about the certificate but will be able to proceed after accepting it.
Why it's wrong here
With certificate-inspection, FortiGate does not re-sign certificates; it only validates them.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with an SSL deep inspection profile that uses 'Certificate Inspection' (not 'Full SSL Inspection'). Which of the following is TRUE about this configuration?
hard- A.Deep inspection can still see client certificates
- B.The antivirus profile can scan the HTTPS payload
- ✓ C.The FortiGate can block HTTPS connections based on the certificate's CN
- D.IPS can still inspect the application layer of HTTPS traffic
Why C: Certificate Inspection only examines the SSL/TLS certificate presented during the handshake, without decrypting the traffic. Because the FortiGate can read the certificate's Common Name (CN) or Subject Alternative Name (SAN), it can block HTTPS connections based on that information, such as by using a URL filter or application control rule that matches the certificate's CN. This is the only deep inspection action possible without full decryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.