FortiGate SSL Inspection Cert Error: diagnose test application wad When One App Breaks

FortiGate · Techclick CLI troubleshooting lab

Deep inspection is on. One mobile app dies. Browser sites are fine after the Fortinet root was deployed.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on FortiGate for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

The app pins certificates. Exempt that FQDN from deep inspection. wad debug confirms the inspect policy that hit.

Why this ticket shows up

Deep inspection re-signs TLS. Certificate pinning fails even when the enterprise root is trusted by Windows.

Symptoms operators actually see

• Mobile app TLS fail

• Browser OK

• deep-inspection profile on the policy

• Exemption missing

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

diagnose test application wad 2000
diagnose debug application ssl -1
get firewall ssl-ssh-profile
diagnose sys session filter dst 203.0.113.80
diagnose sys session list

How to read that output

If the session is attached to a deep-inspection profile and the client is not a browser, plan an exemption. Do not switch the whole profile to certificate-inspection unless policy allows.

Triage order

1. Confirm the profile is deep-inspection

2. Identify the FQDN from logs or SNI

3. Add it to the exemption list

4. Retest the mobile app

5. Leave inspection on for general web

Classic traps

What you see	Real cause	Fix
Certificate-inspect everything	Only one app pins	Exempt the app
Install more roots on the phone	The app ignores the store	Exemption
Disable UTM	This is TLS inspect, not AV	Wrong control

Proof the ticket is closed

• App opens

• Profile still deep-inspects other HTTPS

• Log shows exemption

Say this in an interview

A single mobile-app TLS fail under deep inspection is a pin. I exempt the FQDN.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/