Meridian Electric Cooperative wants FortiGate to force safe search on a search engine that back-office staff use over HTTPS, using the web filter profile's safe search option rather than a DNS-based rewrite. What does FortiOS need in place for that enforcement to actually take effect on the HTTPS traffic?
Select an answer to reveal the explanation.
Short Explanation
Enforcing safe search means FortiOS has to actually read — and sometimes adjust — the search request itself, not just the domain name being visited. Over HTTPS that request is encrypted, so FortiGate needs to be inspecting inside the session for the enforcement to have anything to act on.
Full Explanation
Safe search enforcement isn't a single mechanism — FortiOS actually offers two paths, and it matters which one is in play. DNS Filter can enforce safe search for a handful of supported engines (Google, Bing, YouTube) by rewriting the DNS response with a CNAME that points the client at the provider's own safe-search endpoint, and that trick works without decrypting anything, because it only touches the DNS resolution step. But that is a narrower, engine-specific technique, and it's fragile: it depends on the client actually using FortiGate's DNS resolution, and it breaks down against encrypted DNS (DoH) or an engine that isn't on the supported list. The safe-search enforcement asked about here is the general, profile-level case — FortiGate recognizing the actual search request and confirming or injecting the safe-search parameter on it — and that requires seeing inside the HTTPS session itself, which only SSL inspection provides. Without decryption, the request and its parameters are opaque, leaving nothing for that enforcement to act on. A static URL filter Block entry defeats the goal outright, since blocking the engine removes access rather than making it safer. An application control signature keyed to a safe-search cookie isn't how this feature works — application control identifies apps and protocols, not query-string parameters, and no such signature exists in that profile type. Operationally: where DNS Filter's CNAME method is unsupported or bypassed, SSL inspection is what closes the gap. Confirm enforcement by checking that safe-search parameters appear in the outbound decrypted request in a debug or log capture.