During full SSL inspection, FortiGate intercepts the encrypted traffic and re-signs it with its own certificate to inspect the content. This process is a form of man-in-the-middle (MITM). Web browsers have a built-in list of trusted Certificate Authorities (CAs). The default FortiGate CA certificate used for SSL inspection is not on this public list. Therefore, when the browser receives the re-signed certificate from FortiGate, it cannot verify the issuer's authenticity against its trusted store, resulting in a certificate warning error. HTTP traffic is not encrypted and does not involve certificates, which is why it is unaffected.

A. The matching firewall policy is set to proxy inspection mode: Both proxy-based and flow-based inspection modes perform full SSL inspection and will cause this error if the CA certificate is not trusted.

B. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions: While certificate extensions are important, the primary and most common cause of this specific, widespread error is the lack of trust in the signing CA.

C. The full SSL inspection feature does not have a valid license: SSL inspection is a core feature of FortiOS and does not require a separate license. A licensing issue would not manifest as a browser certificate error.

1. Fortinet. (2021). FortiOS Administration Guide 7.0.0. "Preventing certificate warnings," pp. 768-769. This section explicitly states, "When SSL inspection is configured, FortiOS intercepts encrypted traffic... To avoid certificate errors, you must download the FortiGate CA certificate and install it in the end user's browser."

2. Fortinet. (2021). FortiOS Handbook - Security Profiles 7.0.0. "SSL/SSH Inspection," p. 273. This chapter describes the mechanism of deep inspection and the need for a trusted CA on the client side.