top of page
Search

ZIA SSL Inspection Certificate Error on One Site: Where to Exempt

  • 3 days ago
  • 2 min read
Zscaler network security troubleshooting lab
Zscaler · Techclick CLI troubleshooting lab
One banking site warns about a Zscaler certificate. Every other HTTPS site is fine.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Zscaler for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Exempt that URL or category from SSL inspection. Do not turn off inspect for the location. Confirm the user actually trusts the Zscaler root.

Why this ticket shows up

ZIA SSL inspection presents a Zscaler-signed cert. Banks and pinned apps reject it. The rest of the web keeps working, which is why this ticket is always 'one site'.

Symptoms operators actually see

  • Certificate name is a Zscaler intermediate

  • Only one FQDN fails

  • Mobile app fails, browser warns

  • Works when user is off ZIA

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# from the user PC
openssl s_client -connect bank.example:443 -servername bank.example </dev/null 2>/dev/null | openssl x509 -noout -issuer -subject
curl -Iv https://bank.example --max-time 10
nslookup bank.example

How to read that output

If issuer is a Zscaler MITM CA, inspection is on. If the user machine does not trust that CA, every site would fail — so a single-site fail is a pin or a policy exemption candidate.

Triage order

  1. Read the issuer of the leaf the client sees.

  2. Confirm the workstation has the Zscaler root in the trust store.

  3. In ZIA, add an SSL inspection exemption for that URL or finance category.

  4. Retest only that host.

  5. Leave inspection on for the location.

Classic traps

What you see

Real cause

Fix

Disable SSL inspect for the site location

One bank pins

Exempt the URL

Install a random root

Cloud already has a recommended root

Use the official Zscaler root

It is DNS

Issuer is Zscaler

It is inspection

Proof the ticket is closed

  • Bank site opens with the real issuer or a planned exemption

  • Other sites still show Zscaler issuer

  • No location-wide inspect disable

Say this in an interview

One-site Zscaler cert warning is an exemption or a pin, not a reason to disable SSL inspection.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page