The "Received fatal alert UnknownCA from client" log indicates the client rejects the firewall's decryption certificate because it doesn't trust the CA. For a valid use case, adding the certificate's Common Name (CN) to the SSL Decryption Exclusion List (Option B) bypasses decryption for that site, allowing traffic to proceed without interruption. This is an immediate fix within the firewall's control.
Option A (revocation checking) addresses different issues. Option C (check expired certificates) is diagnostic, not immediate. Option D (contact site admin) is external and slow. Documentation recommends exclusions for such errors.
Reference: PAN-OS 11.2 Administrator's Guide, "Decryption" section - SSL Decryption Exclusions.