For full SSL deep inspection, FortiSASE performs a man-in-the-middle re-encryption process and therefore must act as a certificate authority. It generates a self-signed (or internal PKI-signed) root CA certificate that administrators distribute to all endpoint trust stores; only after the root certificate is trusted can FortiSASE present forged site certificates and decrypt HTTPS, allowing all security profiles—including web filtering, antivirus, application control, and file inspection—to examine the plaintext.

A – FortiSASE must be trusted by endpoints; third-party CA use without import is impossible for MITM.

B – A root or intermediate CA certificate is mandatory.

C – SSL inspection supports all content-inspection profiles, not just antivirus/file filter.

1. FortiSASE Administration Guide v23.4, “SSL/TLS Deep Inspection”, pp. 90-92.

2. FortiOS 7.4 SSL Inspection Handbook, “Distributing the SASE root CA”, §4.2.

3. Fortinet NSE7 SSE-AD courseware, Module 5 lab manual, Step 3 “Export and install SASE CA”.