An OT vendor's application on the grid-operations network uses certificate pinning and breaks whenever its TLS session is decrypted. The NOC team applies certificate inspection instead of deep inspection to that traffic so they can still log destinations by category. What is FortiGate actually able to determine under certificate inspection?
Select an answer to reveal the explanation.
Short Explanation
Certificate inspection is like reading the label on a sealed envelope: you can see who it's addressed to and who sent it, but you never open it up. FortiGate reads the SNI and the certificate's common name during the handshake, which is enough for domain- or category-based filtering. What it can't do is peek inside the encrypted contents, so file scanning and URL-path filtering are off the table.
Full Explanation
Certificate inspection only examines the unencrypted parts of the TLS handshake — primarily the Server Name Indication and the certificate's common name or subject alternative names — which is enough to identify the destination domain and apply category-based web filtering or logging without ever decrypting the payload. Because the session stays encrypted end to end, the pinned-certificate OT application keeps working normally: FortiGate never substitutes its own certificate, so the client's pinning check never fails. The first wrong option describes deep inspection, which does decrypt and can see the full request path and transferred content, but that is precisely the behavior this scenario needs to avoid. The antivirus claim fails for the same reason — scanning file content requires the payload to be decrypted first, and certificate inspection never decrypts anything. The last option overstates the limitation; certificate inspection does actively participate in the TLS handshake and does yield usable handshake metadata, it simply stops short of decryption. As an operational check, confirm the SSL/SSH inspection profile applied to the policy is set to certificate inspection rather than deep inspection, and verify the pinned application's sessions no longer trigger certificate-mismatch errors.