A user reports that their computer was infected with malware after accessing a secured HTTPS website. However, when the administrator checks the…

The core issue is that FortiGate cannot inspect the content of encrypted HTTPS traffic by default. Standard certificate inspection only verifies the server's certificate and uses the Server Name Indication (SNI) for web filtering, but it does not decrypt the traffic payload. To detect malware hidden within an encrypted session, FortiGate must perform deep inspection. Enabling full SSL inspection configures the FortiGate to act as a "man-in-the-middle," decrypting the traffic, applying security profiles (like Antivirus and IPS) to the plaintext content, and then re-encrypting it before forwarding it to the user. This is the only method that allows FortiGate to analyze the actual data being transferred for threats.

A. This option uses FortiGuard ratings for web filtering but does not decrypt and inspect the traffic's content. A reputable website can be compromised to serve malware, which this method would miss.

B. Certificate inspection already uses SNI to identify the website for policy matching. This does not enable payload inspection, which is necessary to find malware within the encrypted stream.

C. DNS over TLS secures DNS queries to prevent spoofing and eavesdropping. It does not provide any mechanism for inspecting the content of the subsequent HTTPS session where the malware resides.

1. FortiGate Security 7.0 Study Guide

p. 119: "Full SSL inspection

also known as deep inspection

is a more advanced and resource-intensive method of SSL inspection. FortiGate impersonates the recipient of the originating SSL session

and then decrypts and inspects the content... Full SSL inspection allows FortiGate to apply security features

such as antivirus

web filtering

and data leak prevention

to encrypted traffic." This directly states that full inspection is required to apply security features like antivirus to encrypted traffic.

2. FortiOS 7.0.0 Administration Guide

Security Profiles > SSL/SSH Inspection > SSL/SSH Inspection

Section: Inspection modes: "Full SSL inspection (or deep inspection) involves the FortiGate unit becoming a man-in-the-middle... This allows the FortiGate to decrypt the traffic to scan it for threats

and then re-encrypt it before sending it to its destination." This confirms that decryption for threat scanning is the purpose of full inspection.

3. FortiOS 7.0.0 Administration Guide

Security Profiles > SSL/SSH Inspection > SSL/SSH Inspection

Section: Inspection modes: "In certificate inspection mode

the FortiGate unit only inspects the SSL certificate... FortiGate can only apply security features that do not require inspection of the traffic's payload

such as web filtering by SNI." This explains why the administrator's initial configuration failed to detect the malware.