SSL Forward Proxy decryption is configured, but the firewall uses Untrusted-CA to sign the website...

For SSL Forward Proxy, the firewall generates certificates signed by its CA (here, Untrusted-CA), causing warnings if not trusted by clients. Importing Well-Known-Intermediate-CA and Well-Known-Root-CA into the Default Trusted Certificate Authorities (Option C) and marking them as trusted allows the firewall to issue certificates within this chain, eliminating warnings for sites like important-website.com (Requirement 1). Other untrusted CAs remain untrusted, triggering warnings (Requirement 2).

Option A (install on clients) is impractical and bypasses firewall control. Option B (Forward Untrust) affects all untrusted sites, violating Requirement 2. Option D (Device Certificates) is for firewall auth, not proxy trust. Documentation supports this method.