FortiEMS, Forti-Proxy and Untrusted Certficates

[dwillynt]

I would like to know how the process for Enterprise Management Server works for doing ssl packet inspection. I have tested a computer using Fortigate and deep packet inspection on the Fortigate and was able to get a website up without any untrusted certificate warnings. The computer was tested without FortiClient and default CA_SSL proxy certificate was used and pushed down to the laptop. I should note that no AD is involved as this is an all MacBook shop. 

We have a GoDaddy wildcard certificate and for SSL VPN we have are pushing the same CA_SSL proxy certificate down through FortiEMS. However, we are getting untrusted certificate warnings. If I turn off Forti-Proxy, then it kills web filtering but I no longer get an untrusted certificate error. I don't know enough about the process to know where the problem is occurring. Does FortiEMS do web filtering through the server, or does it try to push it to gateway IP (Fortigate). We don't have a gateway IP, so I am assuming it is trying to do this locally.