The billing back-office segment only needs FortiGate to enforce category-based web filtering on HTTPS traffic (blocking known-bad domains) and does not require the firewall to detect malware hidden inside encrypted downloads. Which SSL inspection choice satisfies this requirement with the least decryption overhead?

Certificate inspection reads the SNI and certificate common name exchanged during the TLS handshake, and that destination-domain information is sufficient input for FortiGuard category-based web filtering, since categories are typically assigned at the domain level. Choosing certificate inspection here avoids the CPU cost, certificate-substitution complexity, and pinning-breakage risk of decrypting every session, which matches a requirement that explicitly does not need payload-level malware detection. Deep inspection is not required to enable web filtering by category — that claim overstates what decryption buys you for this specific requirement, though deep inspection would be needed if the utility later wanted URL-path-level filtering or content scanning inside the encrypted stream. Disabling security profiles altogether is unnecessary and wrong: HTTPS traffic absolutely can be filtered by category without full decryption, which is the entire point of certificate inspection existing as a middle option. SD-WAN performance SLA is a routing and link-selection mechanism and plays no role in what content categories are permitted. As an operational check, review web-filter logs after applying certificate inspection to confirm blocked-category events are being generated for HTTPS destinations without any decrypted-content indicators appearing.