>>105880497
>trust the root CA certificate of the fortigate on ALL devices which initiate an SSL/TLS session
You could just inspect the ones that are worth inspecting and add another, more general rule for the rest below.