cant remove SSL inspection profile

if i uncheck all other UTM features (AV, Web, APP, Email) in the policy then it allows me to turn off ssl/ssh inspection. as soon as a put any of them back it comes back by itself. i checked two different units (100d, f/w 5.2) and the behaviour was the same. can someone xplain this to me?

I don' t know if I would classify this as a bug persay but I would open a ticket with support. You can still disable all the options within the profile and the certificate based check should only apply for webfiltering, which can be disabled in the webfilter profile anyway, so its probably not a big deal to leave it like that.

You may select SSL inspection profile by which you disable the inspection for the intended protocol. Mohammad

You need to select " Full SSL inspection" radio box under the inspection method Mohammad

These changes in 5.2 are documented in the What' s New guide ... not an ideal design ... but not a bug as well.

If any security profile is used in a security policy, SSL inspection will automatically be enabled, at which point an SSL mode must be selected ...

ok i still dont really know what it does. can anybody explain how it works?

In SSL inspection profile, you are basically enabling the man-in-the-middle for specific protocol type (https, ssh, imaps, etc). this is to tell the FortiGate either to look into the plain text tarffic only, or to put the effort to intercept encrypted traffic, so it can look into it. this is the simplest i believe Mohammad