Not all websites send their complete certificate chain even though the
RFC
5246 TLSv1.2 standard requires authenticated servers to provide a valid
certificate chain leading to an acceptable certificate authority (CA). When you
enable decryption and apply a Forward Proxy Decryption profile that
blocks sessions with untrusted issuers
to a Decryption
policy rule, if an intermediate certificate is missing from the certificate list the
website’s server presents to the firewall, the firewall can’t construct the
certificate chain to the top (root) certificate. In these cases, the firewall
presents its Forward Untrust certificate to the client because trust can't be
established without the missing intermediate certificate.