TLS Inspection Is a Certificate Management Problem Too

Enabling TLS interception on a firewall looks simple.

The architecture is not.

In a deep inspection flow, the security appliance effectively sits between the client and destination:

Client
→ Firewall
→ TLS inspection
→ Destination

To avoid certificate errors, the client must trust the CA used by the firewall.

This immediately creates operational questions:

How will the CA be distributed?
Are the endpoints domain joined?
Is an MDM available?
What about BYOD?
What about mobile apps?
Which applications use certificate pinning?
How are exceptions documented?

There is also a performance problem.

Decrypting, inspecting and re-encrypting traffic requires CPU resources.

This means firewall sizing based only on raw L3/L4 throughput can be misleading.

The general rule:

TLS inspection is not just a security feature. It is an endpoint, PKI and capacity-planning project.

Practical FortiGate example:

https://sistro.net/fortigate-ssl-deep-inspection-cuando-conviene