How to disable HTTPS inspection in TMG 2010?

Question

Computer networks

In the TMG console, checking HTTPS traffic is disabled completely, however, on some clients, when accessing HTTPS sites, if you look at the certificate chain, you can see that a TMG (Generic Root CA) certificate is slipped.

Because of this, some specific services do not work, such as bank-clients, etc.
The strangest thing is that for some clients (all machines in the domain with the same proxy settings and hanging in the same rule), a certificate is not slipped, and another is slipped to some (Generic Root CA 3).
I tried to enable inspection and generated a new certificate, but everything remained unchanged.

Answer 1

This may be due to the HTST mechanism on the sites.