Description
This article explains the 'Force Certificate Inspection' option in FortiSASE Firewall Policy.
Scope
FortiSASE Firewall Policy Configuration.
Solution
Once this option is enabled, the Firewall policy will use 'Certificate Inspection' only and will not perform SSL Deep Inspection, even when SSL deep inspection is defined in Profile Group.
Below features will require SSL Deep Inspection to inspect traffic:
- Split DNS.
- Web Filter with Inline-CASB.
- Safe Search in Web Filter.
- File Filter.
- DNS filter.
- Application Control with Inline-CASB.
If using the above features, do not tick 'Force Certificate Inspection' in the Firewall policy.
This option can be ticked to surpass deep inspection for certain security-intensive traffic. For example, banking or financial sites (Banking websites may not allow deep inspection).
Note:
FortiGuard category-based Web Filter will still function when 'Force Certificate Inspection' is enabled.
