# ZIA SSL inspection — decrypt without breaking apps

Source: https://ai.techclick.in/blog_zscaler_zia_ssl_inspection
Markdown: https://ai.techclick.in/blog_zscaler_zia_ssl_inspection.md
Publisher: Techclick Infosec Pvt Ltd

Pilot Decrypt, deploy the inspect CA, exempt pinned apps. Apex Freight ticket, portal mock, scored quiz.

## The ticket

 Priya at Apex Freight: “After you turned on Decrypt, Outlook on the web is fine, but the desktop finance app shows a certificate error.” That is an  SSL inspection  ticket, not a URL block and not a ZPA ticket.

  Hero · inspect vs exempt
  User TLS session hits ZIA. The inspect rule either decrypts or skips. Pinned apps belong on Exempt.
  Quick answer

 ZIA intercepts TLS and issues a certificate signed by the inspect CA. The laptop must trust that CA. Apps that pin certificates cannot be inspected — exempt them. Never disable Decrypt for the org on a P1.

## Mental model — three parts

- Trust — Zscaler intermediate CA (or your custom intermediate signed by corp CA) is in the OS / browser / Java store.

- Rule — Policy → SSL Inspection. First matching rule wins. Actions: Decrypt or Do Not Decrypt.

- Exemption — pinned apps and banking/health categories stay out of inspect.

  Flow 1 · TLS at ZIA

   Flow 1 · TLS at ZIA

- Client TLS SNI / CONNECT Public SE inspect rule? Decrypt or skip order matters Web engines URL / DLP / ATP Firewall already ran. If you skip decrypt, later engines see SNI/domain only — not the body. Source: Configuring SSL/TLS Inspection Policy. Say this out loud Inspect is a man-in-the-middle that my users must trust. Pinning means I cannot inspect that app. I exempt it; I do not turn inspect off. Hard words: Inspect CA is the intermediate that signs the forged server cert. Certificate pinning is when the app ignores the OS store and checks a hardcoded cert. Custom intermediate is your CA signing a Zscaler-issued intermediate so corp machines already trust it. ## How to choose inspect vs skip Journey · Client → Inspect → Decide → Access Pilot Decrypt on a group. Prove the CA. Then widen. Source: ZIA TLS/SSL Inspection Leading Practices. Choice Use when Trap Zscaler intermediate CA You can push the cert with Intune/GPO Forgot Java / Firefox / mobile stores Custom intermediate Corp root already on every laptop Zscaler does not use your root private key — it uses the intermediate you signed Decrypt (pilot group) Need DLP / ATP / Cloud App on HTTPS Starting org-wide on day one Do Not Decrypt / exempt Pinned apps, health, banking, IdP if it loops Exempting “any HTTPS” so DLP is blind Source: Choosing the CA Certificate for SSL/TLS Inspection and Certificate Pinning and SSL/TLS Inspection . Decision · inspect or exempt Decision · inspect or exempt Pinned? Exempt Decrypt If the app pins, exempt that app. If it does not, Decrypt so DLP/ATP can see the body. ## Runbook — Side A / B / C ### Side A · laptop (trust) #### Download the CA ZIA Admin → Policy → SSL Inspection → download the Zscaler intermediate (or export your custom intermediate). Source: Choosing the CA Certificate.

- #### Push to stores Intune/GPO: Windows Trusted Root. Repeat for macOS, iOS, Android. Firefox and some Java apps use their own store. Desktop finance tools often need an extra store.

### Side B · ZIA Admin

- #### Pilot rule Policy → SSL Inspection → Add SSL Inspection Rule. Users/Groups = grp-ssl-pilot . Action = Decrypt. Put exemptions above the decrypt rule if they must win.

- #### Pinned apps Exempt the cloud app or a custom URL category. Official examples of pinning pain: Apple, many Microsoft 365 desktop apps, Adobe, Cisco WebEx, Dropbox app, Snowflake. Do not “disable inspect” for those tickets.

     admin.zscaler.net · Policy → SSL Inspection → Add SSL Inspection Rule

     Training mock · not live

       Policy / SSL Inspection / Add SSL Inspection Rule

### Add SSL Inspection Rule

         Rule Order  2

  Rule Name  Pilot-Inspect-Users

   Users / Groups  grp-ssl-pilot

  Action  Decrypt

        Cancel  Save

   Official path: Policy → SSL Inspection. Ascending order. Pilot a group before org-wide Decrypt. Training mock · not live.

### Side C · prove

- #### Browser padlock On a pilot laptop, open a decrypted site. The cert chain should show the inspect CA, not the real public CA.

- #### Web Insights Analytics → Web Insights. Filter user Priya. SSL policy / inspect field should match the rule name. If there is no inspect hit, traffic never decrypted.

## Runtime path after go-live

  Ops · prove the CA
  Green ZCC is not proof of inspect. Quote the inspect rule and the cert chain.
 CONNECT/SNI is classified first. If the inspect rule hits Decrypt, ZIA presents a cert signed by the inspect CA and then URL / ATP / DLP can read the body. If the rule is Do Not Decrypt, later engines work from hostname/SNI only.

## Traps and proof

   Symptom  First check  Do not

  Cert warning on all HTTPS  Inspect CA missing from OS store  Org-wide Don’t Decrypt
  One desktop app dies, browser OK  Pinning or app-specific store  Reinstall ZCC
  IdP / SAML loop after inspect  Exempt login.microsoftonline.com / ACS  Hairpin the IdP through the tunnel
  DLP never fires on HTTPS  Session is Do Not Decrypt  Add more DLP engines first

  Pilot checklist

- grp-ssl-pilot user: padlock shows inspect CA.

- Pinned finance app: exempted, works, rest of HTTPS still inspected.

- Web Insights row quotes the SSL rule name.

  Unsafe path

 Disabling SSL inspection for the company to “prove it is Zscaler.” You lose DLP and threat visibility on the only path that had evidence.

  ← Path hub  ·  Next: DLP + CASB →

## Knowledge check

   Six field tickets. Pick the first safe move.

      Q1  Priya gets a cert warning on one app after a Decrypt pilot. First check?

    Disable Decrypt for the whole org     Is the inspect CA in the laptop trust store / Intune     Rebuild GRE     Delete URL filtering
 Correct:  b . The client must trust the inspect CA before you touch policy. See runbook Side A.

  Q2  Why do some desktop apps break under SSL inspection even when the browser is fine?

    ZIA has no SSL module     DLP engines are off     Certificate pinning / app-specific trust store     ZPA access policy deny
 Correct:  c . Pinned apps (Apple, many Microsoft 365 desktop apps, WebEx, Dropbox app) must be exempted. Official: Certificate Pinning and SSL/TLS Inspection.

  Q3  Official path to add an inspect rule?

    Administration → Authentication     Analytics → Sandbox     Policy → SSL Inspection → Add SSL Inspection Rule     Policy → DLP
 Correct:  c . Documented ZIA admin path. Rules evaluate in order.

  Q4  Does Zscaler install the inspect CA on the laptop for you?

    No — you deploy Zscaler intermediate or your custom intermediate     Yes, automatically for every user     Only on macOS     Only if GRE is up
 Correct:  a . Choosing the CA Certificate for SSL/TLS Inspection: the service does not install the CA on the machine.

  Q5  Safe first action on a P1 cert-pin break?

    Org-wide Don’t Decrypt     Turn off ZCC     Exempt that cloud app or custom URL category; keep the rest inspecting     New App Connector
 Correct:  c . Exempt the pinned app. Do not disable inspect for the company.

  Q6  Inline DLP on HTTPS will not see payload if…

    The session is not decrypted     URL category is Allow     ZCC is green     CASB API is enabled
 Correct:  a . Inspect first, then DLP. Don’t Decrypt means DLP engines never read the body.

       Check answers
       Reset

## Sources

- Configuring SSL/TLS Inspection Policy
- Choosing the CA Certificate for SSL/TLS Inspection
- Certificate Pinning and SSL/TLS Inspection
- Internet & SaaS TLS and SSL Inspection Leading Practices

 Related:  Path hub  ·  ZIA operator path  ·  DLP  ·  GRE/IPSec

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt