NSE7 Troubleshooting and Diagnostics Practice Question
A network administrator runs the command 'diagnose debug application ssl -1' and sees the following output: 'ssl_generate_proxy_cert: cannot find CA certificate for issuer CN=www.example.com'. What is the MOST likely cause?
⚠ Common exam trap
Fortinet often tests the misconception that SSL inspection errors are caused by network connectivity issues or certificate expiry, but the specific error about a missing CA certificate points directly to a misconfiguration in the inspection profile's certificate settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSL/SSH inspection profile is configured with an incorrect CA certificate
The error 'cannot find CA certificate for issuer CN=www.example.com' indicates that the FortiGate's SSL/SSH inspection profile is configured to use a specific CA certificate to re-sign the web server's certificate, but that CA certificate is not present in the FortiGate's certificate store. This occurs when the inspection profile references a CA certificate that has been deleted, not imported, or misconfigured, preventing the generation of a proxy certificate for SSL inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate does not have an internet connection to reach the CA certificate authority
Why it's wrong here
CA certificates are local to the FortiGate, not fetched from the internet.
- ✗
The firewall policy does not have SSL inspection enabled
Why it's wrong here
The debug output shows the inspection process is active, so SSL inspection is enabled on the policy.
- ✗
The web server's certificate has expired
Why it's wrong here
An expired server certificate would generate a different error, not a missing CA certificate.
- ✓
The SSL/SSH inspection profile is configured with an incorrect CA certificate
Why this is correct
If the CA certificate used to sign proxy certificates is missing or invalid, FortiGate cannot generate a new certificate for the inspected site.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.