DUO Security certificates blocked by Web Threat protection

Hello, 

I am using Kaspersky Endpoint Security 11, managed by Security center v.11. I am using Duo Security for 2FA, among other things for authentication to Jira and Confluence server. DUO uses certificates distributed via GPO for endpoint trust. 

I am having issue with KES when Web Threat Protection is turned on that my endpoint is not trusted which indicates that KES is blocking access to certificates. The problem goes away when I disable Web Threat protection, so it is definitely related to it.