Description
This article explains the 'Force Certificate Inspection' option in FortiSASE Firewall Policy.
Scope
FortiSASE Firewall Policy Configuration.
Solution
Once this option is enabled, the Firewall policy will use 'Certificate Inspection' only and will not perform SSL deep inspection, even when SSL deep inspection is defined in Profile Group.
The below features will not work if 'Force Certificate Inspection' is ticked in the firewall policy:
- Split DNS.
- Web Filter with Inline-CASB.
- Safe Search in Web Filter.
- File Filter.
- DNS filter.
- Application Control with Inline-CASB.
If using the above feature, do not tick 'Force Certificate Inspection' in the Firewall policy.
This option can be ticked to surpass deep inspection for certain security-intensive traffic. For example, banking or financial sites (Banking websites may not allow deep inspection).
