The virtual appliance can be setup as a forward proxy server to receive client requests to cloud app domains. The proxy server then generates trusted certificates for those cloud app domains, serving them up to the requesting clients to establish a trusted path.
To enable forward proxy on the Dataplane On-Premises appliance, run
set dataplane forward-proxy enable true