After configuring SSL Forward Proxy for HTTPS inspection, Internal Clients may encounter the SEC_ERROR_UNKNOWN_ISSUER error.

This article explains that the error is related to CA certificates and details the action that is to be taken to resolve the error.

Internal Clients encounter errors such as: SEC_ERROR_UNKNOWN_ISSUER

For Sky ATP to inspect HTTPS packets, SSL Forward Proxy must be configured and the SSL Forward Proxy policy must be applied to the Security Policies that are in use.

Some web browsers, such as Mozilla Firefox, require CA Certificates to be imported to process HTTPS packets from trusted CAs. If this step is not performed, the client may encounter errors such as the above.

To resolve the error, users need to create a PEM format file for the root CA and import it into the appropriate browser. This will allow the web browser to properly decrypt the SSL data that is sent on the HTTPS web page.

For more details, refer to Importing a Root CA Certificate into a Browser in the SSL Proxy Guide.