ssl inspection certificate - which to use

Hello mark8263, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

If you go to SSL/SSH Inspection Profile menu and open/view the deep-inspection profile, you would see only certificate that can be used here is Fortinet_CA_SSL. Because it has to be CA certificate. None of other certificates is usable by default for deep inspection.

 Those certificates you can purchase from like DigiCert, Sectigo, GoDaddy, etc. are server certificates, which you can use for SSL VPN or HTTPS admin access, etc., not CA certs.

You can of course generate a Private CA and issue Private CA certificates. But it requires a proper environment, like Win Domain Controller or MS Intune/MS Cloud PKI then issue certificate from there. Below explain how to do it via a domain controller.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Installing-private-CA-for-deep-inspection/ta-p/270767

Toshi

HI ​@mark8263 

FortiGate Certificate for SSL Inspection:The FortiGate uses a dedicated certificate to intercept and inspect SSL traffic. This is the inspection certificate that the FortiGate presents to clients during SSL inspection.

Root CA Certificate on Clients:Clients need to trust the FortiGate's inspection certificate (or more commonly, the CA that issued it). This involves importing the CA certificate (not the server certificate itself) into the trusted root store on client devices.

Choosing the Certificate:The certificate used by the FortiGate for SSL inspection is typically a self-signed CA certificate or an imported CA cert.  

If you're using a default FortiGate CA cert (e.g., Fortinet_CA_SSL), clients must trust this CA.  
If you generate your own custom CA (e.g., a corporate CA or your purchased cert's CA), then you import this CA into client trusted stores.

plus you need to import this (sub)ca with private key on the Firewall and without key on the client(s)!

This is because the Firewall with DPI will intercept and decrypt the traffic and once inspection is done it needs  to re-encrypt the traffic to pass it to the client. Since it cannot have the private key of the original certificate it needs to have a CA to issue a cert + key that it can use the encrypt the traffic.