While one CAN follow the steps outlined in the article @Dinesh Moudgil shared, it is not generally recommended to follow that approach. Decrypting all outbound traffic will severely constrain the throughput of a Firepower device (on the order of 80-90%).
Also, many sites and applications employ techniques (HSTS, certificate pinning etc.) to be resistant to such "man-in-the-middle" decryption, even from a client-trusted CA.
A better approach is to use decryption policies only for incoming traffic to organization-owned servers for which you have the server's private key.
Protect against malicious secure sites with a combination of Cisco Umbrella and AMP for Endpoints, in addition to the basic URL- and IP-based Security Intelligence blacklisting capabilities in Firepower.
