Which type of certificate must be installed on a Cisco WSA for HTTPS inspection?

A server certificate is used by web servers to authenticate themselves to clients and does not carry the CA signing capability required for the WSA to generate certificates for intercepted sessions.

A client certificate is used to authenticate a client to a server and has no role in enabling the WSA to decrypt and inspect HTTPS traffic.

HTTPS inspection requires the WSA to act as a man-in-the-middle by terminating the TLS session from the client and establishing a new TLS session to the server. To do this, the WSA must generate certificates signed by a trusted root CA - this root CA certificate must be installed on the WSA and distributed to client browsers so that dynamically generated certificates are trusted. Without a root CA certificate, clients will receive untrusted certificate warnings for every inspected HTTPS session.

A wildcard certificate covers specific subdomains of a single domain and lacks the CA signing authority needed to generate trusted certificates for arbitrary HTTPS destinations during inspection.