Maybe a quick question. We have Palo Alto's that perform SSL Decryption using a sub CA certificate issued by our internal Root CA. This is working for our internal windows domain computers as the root CA and sub CA are pushed down to all of them via Group Policy. My question is we have a few Mac users that GPO doesn't work with, so they will manually need to add the certificates.
My question is, if the subCA installed on the Palo Alto (doing Dynamic SSL generation for sites), is also installed on these Macs. Why are the users still getting untrusted connection detected in their browser? It complains that "This certificate cannot be verified up to a trusted certification authority".
If I install the root CA certificate additionally, they no longer receive errors. Hooray!
However, my question is why do clients need the root CA if the sub CA(on Palo Alto) was the one that generated the explicit certificate(such as bankofamerica.com, etc).