Certificate-pinned applications fail when an inspection proxy substitutes a trusted Zscaler certificate for the origin certificate. The application expects the server certificate or public key to match a pinned value and therefore rejects the inspected session. The fastest way to diagnose this is to inspect SSL logs for failed client handshakes, certificate errors, or bypass candidates. Option A (They could look at SSL logs for a failed client handshake) is correct because SSL logs show the handshake failure pattern created by certificate pinning.
Why the other options are incorrect:
B. They could reboot the endpoint device: Rebooting may clear a local issue, but certificate pinning is a TLS validation problem. Logs are the right first place to confirm the failed handshake.
C. They could inspect the ZIA Web Policy: ZIA Web Policy controls web access outcomes. A pinned-certificate failure shows up in SSL/TLS handshake behavior, so SSL logs are more direct.
D. They could look into the SaaS application analytics tab: SaaS analytics show application usage and risk. They will not show the client TLS handshake failure that reveals certificate pinning.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit