The most common root causes are:
- Security Gateway CA has not been imported into client's trust store.
- The client pinning the certificate, the CA or the public key. Such client will never trust the Security Gateway.
Usually in such cases, the client will terminate the connection by sending a TLS alert such as: certificate_unknown(46), unknown_ca(48) , bad_certificate(42).
For more information regarding the exact error alert, look for the received alert in RFC 5246, section-7.2.2