Certificates and SSL inspection

Most of Harbourside's web traffic is HTTPS, and the security team wants to know what the FortiGate can see inside it. Your brief: block a gaming site even over HTTPS, decrypt and inspect general web traffic, and never decrypt the online-banking-style file portal files.example.com, which a regulator says must stay end-to-end encrypted. The internet sites in this lab use certificates from a public-style CA called CorpLab Root CA.

Test from PC1's terminal with curl -skv https://<site>/whoami 2>&1 | grep -E 'issuer|subject|client=', which shows the certificate PC1 received and what the site saw.

Evaluation licence. These VMs use low-strength encryption, and Fortinet documents that low-encryption units can't do full SSL inspection. Our test runs (30 Oct 2026) showed exactly where the line falls: certificate inspection (Task 2) works; deep inspection (Task 3) intercepts each HTTPS session but can't complete it, so the client fails with decryption failed or bad record mac; and the VM imports RSA CA certificates only up to 512-bit keys (2048- and 1024-bit ones fail with Checking CA certificate failed, error -324), which is why CorpLab Root CA here is an ECDSA P-256 CA. Where this VM can't show a result, the pane gives the output of a fully licensed FortiGate and says so.