Zscaler Client Connector
      Back to home
      1. SecureDynamics Knowledge Base
      2. Troubleshooting
      3. Zscaler Client Connector

      How to Install the Zscaler Root Certificate

      Ensure successful SSL inspection and prevent certificate errors by installing the Zscaler Root Certificate on all user devices.

       

      Why This Matters

      Zscaler performs SSL inspection to analyze encrypted internet traffic and protect your environment from hidden threats. For this to work without errors, end-user devices must trust the Zscaler Root Certificate.

      If the certificate isn’t trusted:

      • Users may see certificate warnings or errors
      • Applications (especially on Apple devices) may not function correctly

      Recommended Methods

      You can install the Zscaler Root Certificate in two primary ways:

      ✅ Option 1: Zscaler Client Connector (ZCC) – Most Common & Easiest

      ZCC automatically installs and manages the certificate trust on Windows, macOS, and mobile platforms.

      Benefits:

      • No user interaction required
      • Automatically handles OS-specific certificate stores
      • Dynamically updates as needed

      Requirements:

      • Zscaler Client Connector deployed on user devices
      • Proper SSL inspection policies in place (configured via ZIA Admin Portal)

      🔗 Zscaler Client Connector Admin Guide

      For most deployments, this is all you need—no MDM involvement required if ZCC is installed.

      🛠️ Option 2: MDM, GPO, or Manual Installation

      If you're not using ZCC or need to install the certificate before ZCC is deployed (e.g., for SSL inspection of login pages or pre-logon processes), you can push the certificate directly to devices using:

      • Intune
      • Jamf
      • Group Policy (GPO)
      • Manual installation (testing or unmanaged devices)

      Manual Installation Instructions

      Step 1: Download the Zscaler Root Certificate

      1. Log in to the ZIA Admin Portal
      2. Go to Administration > Certificates
      3. Download the Zscaler Root CA Certificate (.crt or .cer)

      Installation by Operating System

      🪟 Windows

      1. Press Win + R, type mmc, press Enter
      2. File > Add/Remove Snap-in > Certificates (Computer Account)
      3. Navigate to Trusted Root Certification Authorities > Certificates
      4. Right-click > All Tasks > Import
      5. Select the certificate and complete the wizard

      💡 To verify:

      bash
      CopyEdit
      certutil -store root | findstr "Zscaler"

      🍎 macOS

      1. Open Keychain Access
      2. Select System > File > Import Items
      3. Choose the certificate file
      4. Double-click the cert → Set to “Always Trust”

      🐧 Linux (Ubuntu/Debian)

      bash
      CopyEdit
      sudo cp ZscalerRootCA.crt /usr/local/share/ca-certificates/
      sudo update-ca-certificates

      📱 iOS

      1. Email or AirDrop the certificate to the device
      2. Tap the profile > Install
      3. Go to Settings > General > About > Certificate Trust Settings
      4. Enable Zscaler Root Certificate

      🤖 Android

      1. Go to Settings > Security > Encryption & credentials
      2. Tap Install a certificate from storage
      3. Select the file and install under VPN & apps

      Firefox Note (Windows/macOS)

      Firefox uses its own certificate store, separate from the OS.

      1. Open Firefox > Settings > Privacy & Security
      2. Under Certificates, click View Certificates > Authorities
      3. Click Import, choose the Zscaler certificate
      4. Enable Trust this CA to identify websites

      Troubleshooting

      Symptom Fix
      SSL warnings continue Restart browser or PC, verify certificate is in Trusted Root
      Firefox shows cert errors Add cert to Firefox's own cert store
      ZCC is installed but errors persist Confirm SSL inspection is enabled in ZIA and ZCC policy is applied

      Summary

      For most environments, installing Zscaler Client Connector is the simplest and most effective way to deploy and trust the Zscaler Root Certificate.

      However, if you use pre-logon authentication, have unmanaged devices, or want additional control, MDM or GPO certificate deployment may be appropriate.

      Need help deciding which method is best? Reach out to your SecureDynamics engineer or project team for guidance.