I'm testing SSL decryption by applying a policy that only decrypts my traffic. I have my forward trust cert marked as such and is marked as a trusted CA. It has the certificate signing attribute.

SSL profile says min: tlsv2 max version: max. Only block expired certs and untrusted issuers selected.

I can only get to lesser known sites. I see my decrypt cert being presented on these sites and the site loads.

My theory is HSTS on sites like google might be breaking things but I can't figure out why. I can't get to google, reddit, or any well known sites with decryption enabled. Anyone see something like this?

Decryption logs shows "early close notify" error. Foward Trust Cert is installed in my root store.

PA-3410 running 10.2.3