Standard certificate inspection (which relies on the SNI) only identifies the destination domain; it does not allow the FortiGate to see the actual content of the encrypted session. As noted in the lab documentation, " certificate inspection on its own does not help HQ-DCFW to see the encrypted traffic " . To identify and block malware hidden within HTTPS traffic, the FortiGate must be configured with full SSL inspection (also known as deep inspection). This process involves the FortiGate acting as a man-in-the-middle to decrypt the packets, scan the payload for threats using the applied security profiles (like Antivirus or IPS), and then re-encrypt the traffic before sending it to the host. Without full decryption, the unit " will not decrypt packets to analyze if there is a possible attack, " allowing malware to bypass security layers.

==============