Understanding SSL inspection handling in Fortigate

Hello,

I have the following question regarding the SSL inspection process performed by Fortigate, specifically the options below:

I'm trying to understand the order in which these options are analyzed. I understand that a verification flow must be followed, and my current understanding is as follows:

My Logic:

It all starts with cert-probe-failure.

cert-probe-failure = Couldn't get the certificate, so it stops here and takes a block or allow action. If successful, continue >>

cert-validation = Opens the certificate and checks CA, revocation, expiration, and SNI.

According to the information obtained from cert-validation, it will perform the actions set below:

sni-server-cert-check = enable (I understand this check already occurs in cert-validation)

revoked = allow or drop

expired = allow or drop

untrusted = allow or drop

I'm a little confused about these checks. I read in the documentation that cert-probe-failure already

performs validations that other options do, such as untrusted certificate and expired certificate.

Is there any documentation explaining this flow?

Thanks for any help!