URL filtering has changed to allow certificate-based URL filtering for HTTPS traffic, which is used when deep-scan is disabled.

Certificate-based filtering extracts the hostname from the TLS handshake. If a valid hostname is found, it is used for the local or FortiGuard category query. If no hostname is found, HTTPS server CN web filtering will be used instead.