SSL Forward Proxy decryption is configured but the firewall uses Untrusted-CA to sign the website https //www important-website com certificate End-users are receiving me "security certificate is…

Importing the Well-Known-Intermediate-CA and Well-Known-Root-CA into the firewall's certificates (as trusted CAs) ensures the firewall can validate the original certificate chain of important-website.com. Once the firewall trusts the original certificate, it will then use its designated Forward Trust CA (which is typically deployed to end-user machines) to re-sign the website's certificate, thereby eliminating the 'security certificate is not trusted' warning for important-website.com. This allows the firewall to correctly identify other genuinely untrusted websites and use its Forward Untrust CA to generate warnings for them, meeting both requirements.

End-users already trust the Well-Known-Intermediate-CA and Well-Known-Root-CA, which is evident because the site is trusted without decryption; installing them again will not fix the firewall's decryption behavior or its internal trust decisions.

Disabling the Well-Known-Intermediate-CA and Well-Known-Root-CA in the firewall's trusted certificate authorities would further prevent the firewall from validating important-website.com, worsening the problem by ensuring it's treated as untrusted.

Clearing the 'Forward Untrust Certificate' checkbox would likely prevent warnings for *all* untrusted websites by changing how the firewall handles them, directly contradicting the requirement that end-users *should* get warnings for other untrusted websites.