Certificate Inspection vs Full SSL Deep Inspection on FortiGate
What is the difference between certificate inspection and full SSL deep inspection on a FortiGate?
Quick Answer
The answer is that certificate inspection only validates the server certificate, while full SSL deep inspection decrypts and inspects the entire session content. This distinction is critical because certificate inspection merely checks the authenticity and validity of the SSL certificate presented by the server, ensuring it is not expired or revoked, but it never decrypts the traffic. In contrast, full SSL deep inspection performs a man-in-the-middle decryption, allowing the FortiGate to re-encrypt and analyze the payload for threats like malware or data exfiltration. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of how security profiles apply to encrypted traffic; a common trap is assuming certificate inspection provides content-level security. Remember the memory tip: “Certificate checks the ID, deep inspection reads the mail”—certificate inspection only verifies the handshake, while deep inspection opens the envelope to see what is inside.
⚠ Common exam trap
Many exam-takers confuse 'certificate inspection' with 'deep inspection,' assuming both decrypt traffic, but Fortinet specifically defines certificate inspection as a non-decrypting, lightweight validation method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content
Certificate inspection only validates the server certificate's authenticity and checks for revocation, but does not decrypt the traffic payload. Full SSL deep inspection (also called SSL inspection) decrypts the entire SSL/TLS session, allowing the FortiGate to inspect the content for threats like malware, data leaks, or policy violations. This is why option B is correct: certificate inspection validates the certificate, while deep inspection decrypts and inspects the content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Certificate inspection decrypts traffic; deep inspection does not
Why it's wrong here
The roles are reversed: certificate inspection reads only the TLS handshake, including the SNI and certificate details, leaving the payload encrypted, while deep inspection decrypts the session to scan content. Deep inspection is chosen when malware or data leakage inside encrypted traffic must be detected.
- ✓
Certificate inspection only validates the server certificate; deep inspection decrypts and inspects the content
Why this is correct
Certificate inspection reads only the server certificate's subject and issuer fields to validate trust, leaving payload encrypted. Deep inspection terminates the TLS session, decrypts traffic, and inspects content, which is the actual axis distinguishing the two inspection modes.
- ✗
Deep inspection is faster than certificate inspection
Why it's wrong here
Full deep inspection terminates each TLS session, decrypts, inspects and re-encrypts the payload, adding processing overhead that certificate inspection avoids by reading only handshake metadata. Deep inspection is selected when content-level threat detection outweighs that performance cost, not for speed.
- ✗
Both provide the same level of security
Why it's wrong here
Certificate inspection reads only the TLS handshake metadata, such as the SNI and certificate subject, without decrypting the payload, whereas full deep inspection terminates and re-encrypts the session to scan content. Claiming identical security ignores that distinction; deep inspection is chosen where content-level threat detection is required.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. What is the difference between 'certificate inspection' and 'full SSL deep inspection' on a FortiGate?
easy- A.Certificate inspection decrypts the traffic but does not check the certificate.
- B.Deep inspection is less secure than certificate inspection.
- ✓ C.Certificate inspection only validates the server certificate, while deep inspection decrypts and inspects the entire TLS session content.
- D.Both methods provide the same level of inspection.
Why C: Certificate inspection only validates the server certificate's authenticity (e.g., checking the certificate chain, expiration, and revocation status) without decrypting the actual TLS session. In contrast, full SSL deep inspection performs a man-in-the-middle decryption by re-encrypting traffic with a FortiGate-generated certificate, allowing the firewall to inspect the entire payload for threats like malware or data leakage. This distinction is critical for understanding how FortiGate applies security profiles to encrypted traffic.
Variation 2. Which SSL/TLS inspection mode only validates the server certificate without decrypting the traffic?
easy- A.Deep inspection
- B.Flow-based inspection
- ✓ C.Certificate inspection
- D.Proxy-based inspection
Why C: Certificate inspection is the correct answer because it validates the server certificate's authenticity and expiration without decrypting the traffic. This mode checks the certificate chain and revocation status using OCSP or CRLs, but the encrypted payload remains untouched, preserving end-to-end encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.