config firewall ssl-ssh-profile

    edit "deep-inspection"                        # Name of the SSL/SSH inspection profile

        set comment "Full SSL inspection policy"

        set inspect-all enable                    # Enable deep inspection for all SSL traffic

        set caname "Fortinet_CA_SSL"              # CA certificate used to re-sign SSL traffic

        set untrusted-caname "Fortinet_Untrusted_CA"  # CA used for untrusted certificate re-sign

        set untrusted-cert {block|allow|inspect}  # How to handle untrusted server certificates

        set expired-cert {block|allow|inspect}    # How to handle expired certificates

        set cert-validation-timeout {block|allow} # Timeout behavior for certificate validation

        set client-cert-request {bypass|inspect|block} # How to handle client certificate requests

        set ssl-exemptions "10.0.0.0/8" "facebook.com" # Bypass SSL inspection for these IPs/domains

        set ssl-algorithm {high|medium|low}       # Allowed SSL/TLS algorithm strength

        set server-cert-validation enable         # Validate server certificate chain

        set supported-versions "tls1-2" "tls1-3"  # Supported SSL/TLS protocol versions

        set ssh-policy {disable|deep-inspection|certificate-inspection} # SSH traffic inspection mode

        set log-invalid-cert {enable|disable}     # Log invalid certificate events

        set ssl-allow-ssl-v3 disable              # Disable legacy SSLv3

    next

end