When Zscaler performs SSL/TLS inspection, it acts as a forward proxy and establishes two separate encrypted sessions: one with the user and one with the destination server. The user ' s browser does not see the original server certificate directly. Instead, it sees a Zscaler-generated substitute certificate signed by the trusted Zscaler intermediate CA so that encrypted content can be inspected for policy, malware, and DLP enforcement. Therefore, Option D (Zscaler generated MITM Certificate) is correct.
Why the other options are incorrect:
A. No certificate, as the session is decrypted by the Service Edge: A Zscaler Service Edge enforces traffic policy; it is infrastructure, not the API resource URL itself.
B. A self-signed certificate from Zscaler: A self-signed certificate would not chain to the enterprise-trusted Zscaler root CA and would trigger browser trust warnings in normal inspection deployments.
C. Real Server Certificate: The real server certificate is shown only when inspection is bypassed or passed through. With SSL inspection enabled, the browser sees a Zscaler-generated substitute certificate.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit