Zscaler ZIA SSL Inspection: How It Works, What It Breaks, and Where Your Data Gets Decrypted
.jpeg)
Zscaler ZIA SSL inspection decrypts your users' HTTPS traffic inside a Zscaler data center. ZIA sits in the middle of the connection, presents its own certificate to the user's device, reads the decrypted traffic, applies policy, then re-encrypts it and sends it to the destination. Without it, ZIA can only see the domain, not the page, the upload, or the account.
Almost all web traffic is encrypted now. So SSL inspection isn't an optional extra on a secure web gateway. It's the feature that makes the rest of the features work.
How does ZIA SSL inspection work?
- The user's device opens an HTTPS connection.
- The traffic is forwarded to a Zscaler enforcement node.
- Zscaler terminates the TLS session and presents a certificate signed by a Zscaler root CA, or by your own intermediate CA.
- Zscaler inspects the decrypted content: URL path, files, form posts.
- Zscaler opens a separate TLS session to the real destination.
For step 3 to work without browser warnings, every device has to trust the signing certificate. That means pushing a root certificate to your whole fleet.
What does SSL inspection let ZIA see?
| Without SSL inspection | With SSL inspection |
|---|---|
| Domain only (chatgpt.com) | Full URL path |
| No file visibility | File uploads and downloads |
| No account context | Which tenant or account is signed in |
| No DLP on encrypted traffic | DLP on prompts, posts, and uploads |
| Limited malware scanning | Malware scanning inside the session |
This is why DNS-only tools miss so much. The interesting part of the request is inside the encryption.
What breaks when you turn it on?
- Certificate-pinned apps. Some apps only trust their own certificate and fail when a proxy steps in. Others use hard-coded IPs or app-specific SSL settings. You'll build a bypass list.
- Privacy-sensitive categories. Teams running a cloud proxy commonly bypass whole categories like healthcare and banking, because nobody wants that data sitting decrypted in a third-party data center.
- Performance. Decrypting and re-encrypting takes work, and with ZIA that work happens after the detour to the data center.
Bypass lists are normal for every vendor. The question is how fast you can find what broke and fix it.
Where does your decrypted data live?
This is the part buyers skip. With a cloud proxy, your users' traffic exists in plaintext on infrastructure you don't own, in a location decided by routing. For most companies that's an accepted risk. For teams with data residency rules, it's a conversation with legal.
It also creates a visibility gap. Every category you bypass for privacy is a category your security policy can't see.
ZIA SSL inspection vs on-device SSL inspection
| Zscaler ZIA | dope.security | |
|---|---|---|
| Where decryption happens | Zscaler data center | On the user's device |
| Plaintext leaves the device | Yes | No |
| Extra network hop | Yes | No |
| Sensitive categories | Often bypassed | Inspected locally, visibility across every category |
| Finding broken apps | User notices, logs a ticket, admin investigates | Endpoint reports the SSL error, admin bypasses from the notification panel |
| Coverage | Any forwarded traffic | Managed Mac and Windows |
dope.security runs SSL inspection on the endpoint. The session is decrypted, inspected, and re-encrypted on the laptop, and the traffic flies direct to the destination. Three things follow from that:
- It's safer. Data never leaves the device.
- It's faster. No decryption in a data center that might be across the country.
- It's more reliable. The decryption zone moves with the user, so it's always available.
It also fixes the bypass problem faster. When an SSL inspection error occurs, dope.endpoint reports the URL or application to dope.cloud. Admins see it in the notification panel and add it to the bypass list for the whole organization. No waiting for a user to file a ticket. A default bypass list ships for apps that are known to break, and you can add your own.
A Fortune 100 customer credited that SSL error notification feature as one reason it scaled from 900 to more than 18,000 devices in weeks.
What on-device inspection makes possible for AI tools
Seeing inside the session is what lets you tell a corporate account from a personal one on the same domain. With dope.security that becomes three layers:
- Shadow IT discovery. See who's using ChatGPT or Claude, how often, and whether the account is personal or corporate.
- SWG policy. Block, Warn, or Allow the AI/ML Applications category, with rules per user or group. Customize the Block and Warn screens to coach users on policy.
- Cloud Application Control. Enter your ChatGPT Enterprise workspace ID or Claude Enterprise organization ID. Only those tenants are allowed, and the rule holds even if the AI/ML category is blocked.
Setup is three steps: open Cloud Application Control in your SWG policy, select the app and enable control, enter the ID and save. For Claude it covers the browser and the desktop app.
Frequently asked questions
Does Zscaler decrypt HTTPS traffic?
Yes, when SSL inspection is enabled. ZIA decrypts HTTPS in Zscaler's data centers, inspects it, and re-encrypts it before sending it on.
Can Zscaler see my passwords?
With SSL inspection on, traffic is decrypted for inspection, so its contents are technically visible to the inspection engine. Many organizations bypass banking and healthcare categories for that reason.
Do I need to install a certificate for Zscaler SSL inspection?
Yes. Devices have to trust the Zscaler root certificate or your own intermediate CA, or users will see certificate warnings.
Why do some apps break with SSL inspection?
Certificate validation issues, hard-coded IP addresses or domains, and application-specific SSL configurations. Apps that only trust their own certificate reject the proxy's certificate, so they need a bypass.
Is on-device SSL inspection safer?
It keeps decrypted traffic on the device instead of in a vendor's data center, which is better for privacy and data residency.
Inspect everything. Send it nowhere.
Start a free trial and watch SSL inspection run on your own laptop.
.jpeg)
