Hi,
I could not test it before as I had to go back because of a family tragedy. . I came back yesterday and resumed testing in a slightly different scenario due to company restrictions on using a fully managed test machine. My current setup places the test machine behind the company’s main firewall, connected to an isolated test firewall environment via VPN. During initial testing, I used a self-signed dummy certificate for HTTPS inspection. First issue I faced was, although I deleted that certificate from all known locations, I suspect it's still lingering somehow as I am unable to install a fresh certificate from gateway>https inspection, but can renew it with a new self signed one. I read about a tool that might help completely remove it, but I wanted to ask here first before proceeding.
Based on my understanding, all external HTTPS sites should fail or show certificate warnings if the certificate is untrusted—but the behavior is inconsistent. For example, some sites like nayatel.com still open, while others don’t proceed past the security warning. When I blocked traffic, the UserCheck page does appear as expected but I was able to resolve this after enabling UserCheck on all interfaces ( thanks to your document 🙂 ), I now see that blocked sites get the firewall’s VPN certificate and show the block page properly, but other sites like Google are still receiving the self-signed certificate, leading to errors attached. I'm unsure if this is due to certificate caching, inspection misconfiguration, my lack of knowledge in this aspect or some remnant of the previous setup. Any suggestions or insights would be appreciated.
To summarize, Is there any way to delete the self-signed certificate? Should external websites work with self-signed (not valid certificate) after warning sign and should it show a block page with the same certificate (which It is showing now). I have attached some images as well.
