Certificate for Sophos Web Protection Warnings?


I need to reopen the question from an older "comment" by Robert, seen here:

As most of the web is ssl by now, a lot of our users continously raise tickets about ssl errors, as they don't see, that the site is blocked by sophos/design/management request.

Expected behaviour:
* User must be made aware of that the site is blocked through web control/sophos and not because of some ssl error

This for sure can be achived by sticking a CA Certificate in AD or by some kind of popup through the sophos client or something else. It used to work onsite (UTM) with pushing an additional CA cert out to the clients, but we are certainly open for other solutions.

Please provide any solutions besides switching the software?