This certificate replaces the original certificate-signing authority only when that authority certificate is trusted by the firewall. If the authority is not trusted, then the certificate is made self-signed.
To avoid certificate errors, choose a certificate that is trusted by devices that are protected by DPI-SSL.
To manage your certificates, go to Device | Settings > Certificates. Certificates signed by an authority trusted by the firewall are re-signed using this certificate.