UniventionCorporateServer behind XG in DMZ - Problems with certificate and more

Hello,

im running an UTM on an ESXi Server. In the DMZ I have an Univention Corporate Server (UCS) with a Lets Encrypt certificate. The UTM has a DNAT rule an the UCS has a DNS host (ucs.domain.de) so I can reach the UCS by usc.domain.de from internal and external.

--> Everything works perfect :-)

Now I´m trying to migrate to XG. And here the trouble beginns.

I made a Business Application Rule:

If I now enter the URL into a Browser I get an certificate error:

Why do I see a certificate from Sophos and not my Let´s Encrypt??

At what point dose the XG change the ceritifikate?

I also addes a DNS Host:

But this makes no diffence.

As I said on the UTM eyerthing is perfect.

Can anyone help me?

Thanks

Frank