HTTPS Inspection and Multiple Ingress Interfaces

[genisis__]

Query -  If I have a GW with HTTPs inspect enabled, but have multiple ingress interfaces that traffic needs to be inspected how does this work.
I assume that when the CA certificate is generated this will have a FQDN, this FQDN would then be resolved by DNS, to an IP, so if the GW interface IP is different would this cause a problem?

I've not seen an SK in order to create a CA certificate with SANs, or I could have tried that with multiple 'A' records in DNS.

[PhoneBoy · Accepted solution]

Forked this into a new thread, given the age of the thread this was posted to.

The answer is the number of ingress/egress interfaces shouldn't matter here.

For outbound inspection (i.e. users browsing the Internet), the certificate is generated "on the fly" using the same DN, etc as the original certificate.
Provided the end user trusts the gateway's CA, the certificate should validate.

For inbound inspection (i.e. users from the Internet browsing YOUR servers), you're using either the original server certificate OR one that a random user on the Internet should be able to validate.
Here, SANs might be useful (especially if the certificate serves multiple sites).