If the gateways use certificates, the certificates can be issued either by the Internal Certificate Authority (ICA) on the Security Management server, or by a:

A.
External Server CA

B.
Enforcement Module

C.
Third party OPSEC certified CA

D.
No Certificate Authority asideICA

E.
SecurityGateway CA