When using HTTPS inspection, the firewall acts like a "man in the middle" and folds the SSL session into two sessions, one between client-firewall and one between firewall-site.
To perform these actions, the firewall presents the certificate that was configured on the HTTPS inspection on the gateway object.
In some cases, the wrong type of certificate is imported to the firewall, e.g. a certificate that was issued to a single host, and not a sub-CA certificate or Root CA certificate that is allowed to issue certificates for various URLS.
When the client is trying to access some HTTPS website and the firewall presents a certificate that was issued to another host (e.g certificate for www.checkpoint.com when the site is www.gmail.com), the browser will be able to validate the certificate, but will display an error that there is a mismatch between the URL and the certificate host attribute.