筆者在使用Bluecoat SG做網頁代理時，需要對SSL連接進行統一驗證，因此需要向域CA服務器申請一張Subordinate CA證書。
下文介紹了怎樣申請這張證書。
因為參考文檔都是英文的，比較簡單就不翻譯了, 只有注釋的地方用中文。
Step 1: Create a keyring and CSR on the ProxySG appliance
In the Management Console, select Configuration > Keyrings > Create.
After you create the CSR, click OK > Apply.
Select the keyring again and click Edit.
Copy the data that you see under Certificate Signing Request.
Step 2: Create a signed certificate using your corporate PKI system and import the certificate into the keyring
Go to the Microsoft Certificate Service.
Click Next.
A Certificate Issued page appears.
Then, locate the downloaded certificate and open it in a text editor.
這里有個問題，有時直接在Web頁面申請證書沒有Subordinate CA這個類型。這個問題也困擾了我，還好有谷歌，找到用PowerShell直接申請的方法：
登錄到CA服務器，用Administrator打開PowerShell運行
PS D:\SSL_CERT> certreq -submit -attrib "CertificateTemplate:SubCA"
其中D:\SSL_CERT為證書請求存放的路徑
選擇剛才的請求證書文件 SSL-Interception_request.cer；
選擇域CA根證書；
保存為 SSL_Interception_Cert.cer
Copy the contents of the file.
In the ProxySG Management Console, select Configuration > SSL > Keyrings.
Select the keyring you created and click Edit.
Click OK > Close > Apply.
Step 3: Import the certificate signed by the PKI system to be used with SSL interception In the ProxySG Management Console, select Configuration > SSL > CA Certificates > Import.
Paste the certificate that you created on your Microsoft Certificate Server, as well as the Intermediate CA Certificates from the Internal PKI chain.
Click OK > Apply.
Select Configuration > SSL > CA Certificates > CA Certificate Lists > Browser Trusted and click Edit.
Select the new Certificate that you just created as well as the Intermediate CA Certificates from the Internal PKI chain, and move them to the column on the right.
Click OK > Apply.
Step 4: Configure the ProxySG appliance to perform SSL interception
Confirm that the HTTP service on the ProxySG appliance is configured correctly. In the Management Console, select Configuration > Services > Proxy Services.
In this example the ProxySG appliance is set to use the default Explicit HTTP service:
In this example, the appliance is configured to intercept HTTP traffic on ports 80 and 8080, and the Detect Protocol option is enabled.
This must be enabled for SSL interception to work.After you confirm or configure the HTTP service, configure policy rules and layers in the Visual Policy Manager (VPM).
Select Configuration > Policy > Visual Policy Manager > Launch.In the following example, the VPM policy only contains two layers:
The Web Access Layer is set to Allow any Source and any Destination to access the internet.
The SSL Interception Layer contains one rule, which is set to SSL intercept Any source and Any destination.
Enable HTTPS Interception. Set the Issuer Keyring to the keyring that you have created:
Step 5: Check the certificate in a browser
這里可以用GPO將STEP 3生成的證書部署到域中，用戶就不會感覺到變化，仔細的用戶會看到SSL證書已經被替換為次級CA服務器簽發的證書。
You can now run test using a computer that is a member of the domain of which the Microsoft Certificate Server is a member.
Check the certificate that is provided to the browser, as in the following example:
參考鏈接：
https://support.symantec.com/en_US/article.TECH244873.html
