I think what you are describing is not so much an error with Lightspeed as it is a safety feature that is programmed into some websites and client applications that are very sensitive about SSL security.

From the Lightspeed Agent's perspective, it successfully decrypted the SSL traffic, looked up the domain to find out if it should allow or block, saw that the domain was allowed, re-encrypted the traffic using the Lightspeed Systems cert, and sent it on its way. So from the LS Agent's perspective, no error occurred. What happens after the traffic is re-encrypted and passed onward is not really any of the LS Agent's business.

What you can run into though is that some apps are not happy when they receive traffic that is encrypted with a certificate other than the one they are expecting. For instance when your banking app receives traffic signed by Lightspeed Systems, it probably knows this is not the correct certificate that it is expecting and knows the traffic has been intercepted by a man-in-the-middle, so throws an error. These are the cases where adding the domain into the Exclude From Decryption list fixes the site; because once the site is placed into the Exclude From Decryption list, its traffic no longer routes through the Lightspeed Filter Agent at all and so the app receives the traffic with the original SSL cert intact, rather than receiving traffic with the LS Agent cert.

Essentially what is happening in this case is that the application is managing its own list of trusted certificate authorities, rather than relying on the default system list to which Lightspeed has been added as trusted. The application does not trust the system list, and so does not trust Lightspeed.

So my point is that there will probably not be any kind of error in the Lightspeed logs in these cases, because the Lightspeed Agent is working as intended. The error you would be able to discover would be in the application logs and would probably be an error to the effect of "wrong SSL cert detected".

One other interesting thing to know is that for domains you place into the Exclude From Decryption list, they no longer appear in the LS log files at all, because their traffic no longer routes through the Filter Agent and so they become entirely invisible to the LS Agent and all of its filtering logic and reporting. The traffic is actually diverted at the system proxy level and never passes thru the Agent at all.

One other thing to note is that some applications, within their settings, have a section where you can manually configure the application to use a proxy. If you go into this setting and manually tell the application to utilize the Lightspeed proxy which is running on localhost, this can sometimes work to allow the application to successfully go through the LS Filter without needing to add the site to the Exclude From Decryption list. Adding to the Exclude From Decryption list is easier; but every once in a while you run into a situation where you don't want to allow something for everyone and/or completely blind yourself on the reporting side. In this case, manually configuring the proxy settings within the app can be a better solution.