Deep Packet Inspection pinning

What version of code are you running? You can run a few debug commands to see what is happening during the ssl session, from the ssl side of things.

Hello fran,

I posted the debug commands here:

https://forum.fortinet.com/tm.aspx?m=148759&tree=true >>What other reasons could there be for Deep Packet Inpsection failing on some HTTPS websites ?

If you are using proxy-mode:

If you are using an older OS, in your case 5.4.1, the latest 5.4 is 5.4.4, there might be known bugs that have been fixed in the new versions.

If you are using flow-mode:

You can ask support for the latest stable IPS Engine. Deep-inspection done in flow-mode uses a proprietary protocol that does not modify the SSL packets. This means that we update it very frequently as new ciphers are released. Google, as of late, has been trying out a lot of new ciphers on Chrome and even Firefox has followed. In this case, you would need the latest IPS Engine to decrypt those sessions. In proxy-mode, the FortiGate could strip away ciphers that it does not support. Therefore, it is not going to fail because of an unsupported cipher. In flow-mode, the IPS Engine does not strip away ciphers that it does not support. If it does not support a new cipher, the IPS Engine will not be able to decrypt the session.  In case you are wondering, the advantage of the design of the flow-mode decryption is the speed. The most likely sites to run into problems are Google sites. Since it takes modifications on both ends - client and server - other sites would need time to keep themselves up-to-date.

Hope this helps!

HoMing