An administrator switches a firewall policy from certificate inspection to full SSL deep inspection so antivirus can scan HTTPS downloads. Immediately afterwards, internal users on managed laptops report browser certificate warnings on most HTTPS sites, while one application that uses certificate pinning fails to connect entirely. The administrator wants deep inspection to function cleanly without weakening it for everyone. Which TWO statements correctly describe the trust requirements that full deep inspection introduces? Select TWO.
- AThe CA certificate that the FortiGate uses to re-sign server certificates must be present in each client's trusted root store, otherwise browsers warn that the substitute certificate is untrusted. Correct
- BA pinned application still breaks because the FortiGate substitute certificate differs from the one it pins, so that host must be exempted from deep inspection rather than trusting the CA. Correct
- CThe FortiGate must first obtain and import the private key of every external HTTPS server it inspects before it is able to re-sign that server's certificate for the client.
- DEach client must individually import the original public certificate of every website it visits so the browser can match it against the FortiGate re-signed copy.
- ECertificate validation must be turned off in every browser so each client blindly accepts the FortiGate-generated certificate regardless of which CA actually issued the substitute.
Why A is correct: Correct: deep inspection presents each client a server certificate re-signed by the FortiGate CA, and browsers only trust that chain when the FortiGate re-signing CA is installed as a trusted root on the client.
Why B is correct: Correct: certificate pinning compares the presented certificate against a pinned value, and the re-signed certificate never matches it, so the only clean fix is to exempt the pinned host from decryption.
Why C is wrong: This is tempting because deep inspection does involve certificates, but the FortiGate generates a fresh substitute signed by its own CA and never needs the remote server's private key, which it could not obtain for outbound inspection.
Why D is wrong: This is wrong because clients never pre-import remote site certificates; the single trust dependency that removes warnings is the FortiGate re-signing CA in the client root store, not per-site certificates.
Why E is wrong: This is wrong and insecure, because the supported approach keeps normal validation intact and simply trusts the FortiGate CA, whereas disabling validation would accept any forged certificate from any source.