URLF detect events with "Untrusted Certificate" for Microsoft sites with "HTTPS lite"

[Kaspars_Zibarts]

Trying to get my head around as we get many URL Filtering detect events for Microsoft sites when using categorization without HTTPS interception, aka "HTTPS lite"

Lets start with the problem:

I read the sk159872 and added missing Trusted CAs manually, cleared cache and installed policy but events keep coming:

Additionally read sk64521 and there were no automatic downloads available.

Looked at https://www.ssllabs.com/ssltest/analyze.html?d=events.data.microsoft.com as well but got none the wiser what would be the problem.

Chrome shows possible problem with validity length:

Not entirely sure why it is showing as Untrusted. Any ideas?

We are running R80.40 T91.