HTTPs Scanning UTM 9

Question

Hi everyone, 
 
 I am writing you, because I cannot setup properly Https scanning (Decrypt and Scan in Filter transparent mode) with this option Sophos decrypt and scan all HTTPS traffic, I want to make a list of exception when traffic will go without decrypt and scan. First of all I configured and turn on Decrypt and Scan in Filter transparent mode on and made changes in settings Filter Option --> Misc --> Nets or Skip Transparent Mode Destination Hosts and added DNS host example *.bloomberg.com and common bloomberg.com, but it did not help me the sophos continue to scan https traffic. Could you tell me what I am doing wrong? 
 
 Thank you in advance.

DouglasFoster · Answer

Have you read my post "Troubleshooting Web Filtering"? 
 You did not distribute the UTM CA certificate.

Vladimir Kavaravanin · Answer

Ofcouse, I red troubleshoot Web Filtering twice. Even more, the root of the problem is not in the CA UTM certificate, because my idea is in bypass ssl scanning for particular websites such as banks and government. In other words when you goes to website https://bloomberg.com the original certificate should not be changed to UTM CA certificate and bypass ssl scanning. This was the main problem. I can easily implement certificate to Trusted Root Certification Authorities, but I do not want to make Man in the middle attack for websites in my list. 
 From my point of view there is only one way add websites to Filter Options --> Exceptions --> Https scanning in this case you will avoid ssl scanning from the website list, but there is one thing how to upload 100 trusted worldwide websites and do not input it manually. 
 
 Thanks everyone for support. I will implement CA UTM certificate later via GPO.

DouglasFoster · Answer

You can do a list all at once. Here is the process: 
 
 Prepare your list. You probably want to use domains (example.com), not host names (www.example.com), as you want to exempt the organization. 
 Go to Web Protection.. Filtering Options... Websites. 
 Click the [New] button 
 Paste in your list of domains. Ensure to check the box for "Include Subdomains" 
 In the Website Tags box, create a new tag for "HTTPS Scanning Bypass" and verify that it appears in your selected tags list. 
 Save your changes. 
 (This will actually create one object for each entry in the list, but you get to create them all at once.) 
 Go to Web Protection... Exceptions... 
 Create a new exception 
 Check the box to exclude SSL Scanning 
 At the bottom, choose "Going to websites tagged as". Use the folder icon to select the "HTTPS Scanning Bypass" tag that you created earlier.