An engineer is configuring web filtering for a network using Cisco Umbrella Secure Internet Gateway. The requirement is that all traffic needs to be filtered. Using the SSL decryption feature, which…

A generic third-party certificate would not be the root certificate owned and managed by the organization for its internal SSL inspection proxy.

A self-signed certificate would cause browser warnings on all end-user devices unless explicitly installed and trusted by each one.

When enabling SSL decryption with Cisco Umbrella Secure Internet Gateway, Umbrella acts as an intermediary, intercepting encrypted traffic, decrypting it for inspection, and then re-encrypting it before forwarding. To avoid browser trust warnings on end-user devices, the organization's owned root certificate (or an intermediate certificate signed by it) must be installed and trusted by client devices, allowing them to trust certificates issued by Umbrella during the decryption process.

A SubCA certificate would still need to be chained back to a trusted root, typically the organization's own root CA that is distributed to clients, making the organization-owned root the more accurate answer for the core trust anchor.