Certificate inspection
FortiGate supports certificate inspection. The default configuration has a built-in certificate-inspection profile which you can use directly. When you use certificate inspection, the FortiGate only inspects the headers up to the SSL/TLS layer.
If you do not want to deep scan for privacy reasons but you want to control web site access, you can use certificate-inspection.
Inspect non-standard HTTPS ports
The built-in certificate-inspection profile is read-only and only listens on port 443. If you want to make changes, you must create a new certificate inspection profile.
If you know the non-standard port that the web server uses, such as port 8443, you can add this port to the HTTPS field.
If you do not know which port is used in the HTTPS web server, you can select Inspect All Ports.
Block untrusted or allow invalid certificate
The default setting in the certificate-inspection profile is to block invalid certificates and allow untrusted certificates.
For example, the server certificate has expired but you still want to access this server until you have a new server certificate. But because certificate inspection cannot do an exemption, you have to allow the invalid certificate in your SSL profile. This means you need to create a new certificate inspection profile using the built-in read-only certificate-inspection.
