How to properly configure HTTPS inspection on Forefront TMG and ISA Server?

Question

proxy

Hello!
Help in solving the problem.
Forefront TMG sp2 rollup 5 is installed on win 2008 r2. HTTPS inspection is enabled with a certificate from a domain CA. But many sites do not open, because they require CNG API (Certificate New Generation v3), as well as skype and vider do not work, although there is no prohibition rule for them.
Having generated this certificate and installed it according to the manual from this article, the sites began to open. But skype and vider still don't work. The only solution I have found but haven't tried yet is to open all udp ports for these applications.
I don’t want to do this, I’m looking for a solution, but so far without results. Perhaps someone will tell you how to solve or has a ready-made solution? :)