Watchguard Proxy and Untrusted Certificates

[atamakosi]

We've had a Watchguard XTM 500 series for a while now and we've made do with some basic filtering. We initially wanted to run the filter through a proxy to achieve deeper inspection but our student policies always balk at us when we do this. Chrome refuses to open most sites stating the server's certificate is untrusted (the firebox cert). Is there any thing to be done to correct this issue for this policy? It doesn't seem to affect Teachers or Staff who do use the proxy.

[Simplexion]

Are you using HTTPS DPI? If so, you need to put the CA cert in the trusted root on all users computers.

[atamakosi]

Thanks for the response. I exported all the relevant certificates from our Watchguard (instructions) and imported into GPO. I believe though it led me to the correct cause of the problem being OCSP enabled on the Watchguard SSL inspection. If it checked the certificate was revoked then it did not allow the user on to the valid sites. Not sure why the cert came back as invalid still as the expiration date was years away. But thanks for the lead, Simplexion.