Fortigate SSL certificate used - NOT using DPI

[cpattonsfs]

I am using Certificate Inspection, but I an not using Deep Packet Inspection. I visited a website today and got a certificate error, and upon inspection saw that it was the Fortigate certificate.

Why did this occur? It doesn't occur on the vast majority of sites; and when I bypass the filter, I can see that the certificate chain is valid with no problems. So why did the Fortigate substitute its own certificate?

[hmtay_FTNT]

Hello Charlie, 

Do you have a Web Filter or Application Control sensor with entries set to Blocked? If you do and you enabled the setting to send a replacement-message indicating that a page is blocked, the Fortigate will do a MitM to send you the replacement-message page if the session is a HTTPS session.

[cpattonsfs]

I don't have replacement messages for sites blocked by web filter, but under Security Profiles > Application Control I do have "Replacement Messages for HTTP-based Applications" turned on (apparently. I didn't realize I had enabled this). However, I turned it off, and the issue still occurs.

Is there a way I can find out if this is triggering some policy that I just haven't tracked down? Maybe through the logs?

[hmtay_FTNT]

What is the page you are trying to access? You can check in the logs to see which module is triggering on the session and what's the action. Check for the log entries with action Block. I believe it's likely to be one of them.