The ticket
Priya at Apex Freight: “After you turned on Decrypt, Outlook on the web is fine, but the desktop finance app shows a certificate error.” That is an SSL inspection ticket, not a URL block and not a ZPA ticket.
ZIA intercepts TLS and issues a certificate signed by the inspect CA. The laptop must trust that CA. Apps that pin certificates cannot be inspected — exempt them. Never disable Decrypt for the org on a P1.
Mental model — three parts
- Trust — Zscaler intermediate CA (or your custom intermediate signed by corp CA) is in the OS / browser / Java store.
- Rule — Policy → SSL Inspection. First matching rule wins. Actions: Decrypt or Do Not Decrypt.
- Exemption — pinned apps and banking/health categories stay out of inspect.
Firewall already ran. If you skip decrypt, later engines see SNI/domain only — not the body. Source: Configuring SSL/TLS Inspection Policy.
Inspect is a man-in-the-middle that my users must trust. Pinning means I cannot inspect that app. I exempt it; I do not turn inspect off.
Hard words: Inspect CA is the intermediate that signs the forged server cert. Certificate pinning is when the app ignores the OS store and checks a hardcoded cert. Custom intermediate is your CA signing a Zscaler-issued intermediate so corp machines already trust it.
How to choose inspect vs skip
| Choice | Use when | Trap |
|---|---|---|
| Zscaler intermediate CA | You can push the cert with Intune/GPO | Forgot Java / Firefox / mobile stores |
| Custom intermediate | Corp root already on every laptop | Zscaler does not use your root private key — it uses the intermediate you signed |
| Decrypt (pilot group) | Need DLP / ATP / Cloud App on HTTPS | Starting org-wide on day one |
| Do Not Decrypt / exempt | Pinned apps, health, banking, IdP if it loops | Exempting “any HTTPS” so DLP is blind |
Source: Choosing the CA Certificate for SSL/TLS Inspection and Certificate Pinning and SSL/TLS Inspection.
If the app pins, exempt that app. If it does not, Decrypt so DLP/ATP can see the body.
Runbook — Side A / B / C
Side A · laptop (trust)
Download the CA
ZIA Admin → Policy → SSL Inspection → download the Zscaler intermediate (or export your custom intermediate). Source: Choosing the CA Certificate.
Push to stores
Intune/GPO: Windows Trusted Root. Repeat for macOS, iOS, Android. Firefox and some Java apps use their own store. Desktop finance tools often need an extra store.
Side B · ZIA Admin
Pilot rule
Policy → SSL Inspection → Add SSL Inspection Rule. Users/Groups =
grp-ssl-pilot. Action = Decrypt. Put exemptions above the decrypt rule if they must win.Pinned apps
Exempt the cloud app or a custom URL category. Official examples of pinning pain: Apple, many Microsoft 365 desktop apps, Adobe, Cisco WebEx, Dropbox app, Snowflake. Do not “disable inspect” for those tickets.
Policy / SSL Inspection / Add SSL Inspection Rule
Add SSL Inspection Rule
Official path: Policy → SSL Inspection. Ascending order. Pilot a group before org-wide Decrypt. Training mock · not live.
Side C · prove
Browser padlock
On a pilot laptop, open a decrypted site. The cert chain should show the inspect CA, not the real public CA.
Web Insights
Analytics → Web Insights. Filter user Priya. SSL policy / inspect field should match the rule name. If there is no inspect hit, traffic never decrypted.
Runtime path after go-live
CONNECT/SNI is classified first. If the inspect rule hits Decrypt, ZIA presents a cert signed by the inspect CA and then URL / ATP / DLP can read the body. If the rule is Do Not Decrypt, later engines work from hostname/SNI only.
Traps and proof
| Symptom | First check | Do not |
|---|---|---|
| Cert warning on all HTTPS | Inspect CA missing from OS store | Org-wide Don’t Decrypt |
| One desktop app dies, browser OK | Pinning or app-specific store | Reinstall ZCC |
| IdP / SAML loop after inspect | Exempt login.microsoftonline.com / ACS | Hairpin the IdP through the tunnel |
| DLP never fires on HTTPS | Session is Do Not Decrypt | Add more DLP engines first |
- grp-ssl-pilot user: padlock shows inspect CA.
- Pinned finance app: exempted, works, rest of HTTPS still inspected.
- Web Insights row quotes the SSL rule name.
Disabling SSL inspection for the company to “prove it is Zscaler.” You lose DLP and threat visibility on the only path that had evidence.
← Path hub · Next: DLP + CASB →
Knowledge check
Six field tickets. Pick the first safe move.
Sources
- Configuring SSL/TLS Inspection Policy
- Choosing the CA Certificate for SSL/TLS Inspection
- Certificate Pinning and SSL/TLS Inspection
- Internet & SaaS TLS and SSL Inspection Leading Practices
Related: Path hub · ZIA operator path · DLP · GRE/IPSec