During the implementation of SSL Forward Proxy decryption, an administrator imports the company's Enterprise Root CA and Intermediate CA certificates onto the firewall. The company's Root and Intermed

Using a single subordinate CA for both Forward Trust and Forward Untrust would mean clients either trust both (no warnings for untrusted sites) or trust neither (warnings for all sites), failing to differentiate between trusted and untrusted websites as required for effective decryption policies.

For Forward Trust, the firewall needs a CA certificate that clients trust to re-sign certificates of legitimate websites; generating a CA certificate (subordinate to the company's Intermediate CA) ensures it's part of the trusted Enterprise CA chain. For Forward Untrust, a self-signed CA certificate is typically used by the firewall to re-sign certificates of untrusted sites; since this self-signed certificate is not distributed to clients, it generates a security warning in the browser, effectively notifying users about untrusted content.

Generating a self-signed CA for Forward Trust would cause all legitimate websites re-signed by the firewall to generate warnings because clients would not inherently trust the firewall's self-signed CA, unless it was manually distributed to all clients which is not the standard best practice in an enterprise with an existing CA infrastructure.

Generating two subordinate CA certificates (one for trust, one for untrust) would mean both would typically be subordinate to the Enterprise CA and thus potentially trusted by clients if the enterprise CA is distributed, defeating the purpose of the Forward Untrust CA needing to be untrusted by clients to generate warnings.