The question is whether this is a Moodle problem or a Fortigate problem. As far as Moodle is concerned, if your Moodle site will be https://example.com, then that is what you put in $CFG->wwwroot. Worth testing that short-circuiting Fortigate. Especially since Moodle server and the browser both don't like a back-and-forth between HTTP and HTTPS. They cache these things and get confused.
And the "mixed" error is a tell-tale sign. Every time you change $CFG->wwwroot you need to Search and replace the URL in the database.
Once you're certain that Moodle works as expected then you can bring Fortigate in to the picture. Unlikely that there are many here who knows the product. This is the first time I saw it.
Once you're certain that Moodle works as expected then you can bring Fortigate in to the picture. Unlikely that there are many here who knows the product. This is the first time I saw it.