The OT vendor's substation application keeps failing under deep inspection because it pins the destination server's exact certificate and rejects any substitute FortiGate presents. The NOC team wants to keep deep inspection active for all other traffic on that policy while letting this one application through untouched. What is the appropriate mechanism?

An SSL inspection exemption lets an administrator list specific addresses, FQDNs, or FortiGuard categories that FortiGate should pass through without applying deep inspection, while the rest of the traffic covered by the same policy continues to be decrypted normally. That is exactly the surgical fix a certificate-pinning application needs: it never receives FortiGate's substitute certificate, so its pinning check never fails, and every other session on that policy still gets full content visibility. Disabling deep inspection for the entire policy solves the pinning problem but throws away visibility into every other flow that policy handles, which is far more than the utility wants to give up for one application. Tuning the antivirus oversize threshold affects how large files are handled during scanning, not whether a TLS session is decrypted in the first place, so it would not stop the certificate substitution that breaks pinning. Modifying the OT vendor's application to ignore pinning is not something the utility controls and would also weaken that application's own security posture, which is not an acceptable trade to make just to fit a firewall's inspection model. As an operational check, confirm the exempted address actually appears in the SSL/SSH inspection profile's exemption list and verify the pinned application reconnects successfully once the change takes effect.