---
title: Bypassing Certificate Pinning Applications via Zscaler SSL Inspection
description: Certificate Pinning is a security mechanism that binds an application to a specific SSL/TLS certificate or a set of certificates. It helps prevent Man-in-the-Middle (MITM) attacks by rejecting connect
---

[Skip to content](https://securedynamics.net/kb/bypassing-certificate-pinning-applications-via-zscaler-ssl-inspection#main-content)

English

Show submenu for translations

![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- Go to securedynamics.net

 Go to securedynamics.net

 Hello. How can we help you?

- There are no suggestions because the search field is empty.

1. [SecureDynamics Knowledge Base](https://securedynamics.net/kb?hsLang=en)
2. [Support](https://securedynamics.net/kb/support?hsLang=en)

# Bypassing Certificate Pinning Applications via Zscaler SSL Inspection

### **Overview**

Certificate Pinning is a security mechanism that binds an application to a specific SSL/TLS certificate or a set of certificates. It helps prevent Man-in-the-Middle (MITM) attacks by rejecting connections that do not match the pinned certificate. However, this can interfere with legitimate SSL inspection tools like Zscaler, which act as intermediaries to inspect encrypted traffic for security threats.

This KB outlines how certificate pinning works, its challenges for Zscaler SSL inspection, and potential bypass techniques.

---

### **What is Certificate Pinning?**

Certificate Pinning involves embedding the expected SSL/TLS certificate (or its hash) within an application. When the application connects to a server:

1. It verifies the server’s certificate against the pinned value.
2. If there’s a mismatch, the connection is blocked.

Pinning is common in banking apps, high-security websites, and some enterprise systems.

---

### **Impact on Zscaler SSL Inspection**

Zscaler intercepts HTTPS traffic by presenting its own intermediate certificate to the client. For pinned applications, the Zscaler certificate doesn’t match the pinned value, causing the application to fail.

---

### **Steps to Bypass Certificate Pinning**

#### **1. Using Zscaler Bypass Rules**

The easiest and most compliant method involves bypassing SSL inspection for specific applications.

1. **Identify the Application**: Determine the application or URL that uses certificate pinning.
2. **Create a Bypass Rule in Zscaler**:
   
     - Go to the Zscaler Admin Portal.
     - Navigate to **Policy \> SSL Inspection \> SSL Bypass Rules**.
     - Add the domain, IP address, or URL regex pattern to bypass SSL inspection.

**Limitations**:

- Traffic is not inspected, reducing visibility.
- Might not work if the application uses multiple domains.

---

### **Best Practices**

1. Use SSL inspection bypass rules only when absolutely necessary.
2. Document and monitor all exceptions for auditing purposes.
3. Educate users on the implications of SSL inspection and pinning.
4. Regularly review and update Zscaler rules to minimize bypasses.

- [FAQs](https://securedynamics.net/kb/faqs?hsLang=en)
- [Troubleshooting](https://securedynamics.net/kb/troubleshooting?hsLang=en#main-content)

    - [Client Connector Portal](https://securedynamics.net/kb/troubleshooting?hsLang=en#client-connector-portal)
    - [Zscaler Client Connector](https://securedynamics.net/kb/troubleshooting?hsLang=en#zscaler-client-connector)
- [Support](https://securedynamics.net/kb/support?hsLang=en)
- [SecureDynamics Internal](https://securedynamics.net/kb/securedynamics-internal?hsLang=en)
- [Licensing](https://securedynamics.net/kb/licensing?hsLang=en#main-content)

    - [ZIA Upgrades](https://securedynamics.net/kb/licensing?hsLang=en#zia-upgrades)
- [Education & Training](https://securedynamics.net/kb/education-training?hsLang=en)
- [Delivery Services](https://securedynamics.net/kb/delivery-services?hsLang=en)
- [Partner Help](https://securedynamics.net/kb/partner-help?hsLang=en)

[![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png "SecureDynamics Zscaler Logo")](https://cm360.securedynamics.net?hsLang=en)

securedynamics.net Help Center

Copyright © 2026, SecureDynamics

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securedynamics.net/#organization",
  "@type" : "Organization",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "US",
    "addressLocality" : "Santa Clara",
    "addressRegion" : "CA",
    "postalCode" : "95054",
    "streetAddress" : "5201 Great America Pkwy, Suite 320"
  },
  "logo" : {
    "@type" : "ImageObject",
    "url" : "https://securedynamics.net/hubfs/SecureDynamics%20Zscaler%20Logo-1.webp"
  },
  "name" : "SecureDynamics",
  "sameAs" : [ "https://www.linkedin.com/company/3626024/" ],
  "url" : "https://securedynamics.net/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securedynamics.net/#website",
  "@type" : "WebSite",
  "inLanguage" : "en-US",
  "name" : "SecureDynamics",
  "potentialAction" : {
    "@type" : "SearchAction",
    "query-input" : "required name=search_term_string",
    "target" : {
      "@type" : "EntryPoint",
      "urlTemplate" : "https://securedynamics.net/hs-search-results?q={search_term_string}"
    }
  },
  "publisher" : {
    "@id" : "https://securedynamics.net/#organization"
  },
  "url" : "https://securedynamics.net/"
}
```