---
title: Configuring SSL Inspection for Apple Services in Zscaler
description: How to avoid SSL handshake errors with Apple services that use certificate pinning while maintaining effective SSL inspection policies.
---

[Skip to content](https://securedynamics.net/kb/configuring-ssl-inspection-for-apple-services-in-zscaler#main-content)

English

Show submenu for translations

![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- Go to securedynamics.net

 Go to securedynamics.net

 Hello. How can we help you?

- There are no suggestions because the search field is empty.

1. [SecureDynamics Knowledge Base](https://securedynamics.net/kb?hsLang=en)
2. [Support](https://securedynamics.net/kb/support?hsLang=en)

# Configuring SSL Inspection for Apple Services in Zscaler

## How to avoid SSL handshake errors with Apple services that use certificate pinning while maintaining effective SSL inspection policies.

 

---

#### Overview

Many Apple services enforce **certificate pinning**, which can conflict with Zscaler’s SSL inspection. When Zscaler intercepts and re-signs SSL traffic, the pinned certificate check fails—resulting in **SSL handshake errors** and blocked Apple functionality.

This article explains how to configure **Zscaler Internet Access (ZIA)** to work around these issues without compromising security posture.

---

#### Why Certificate Pinning Affects SSL Inspection

Certificate pinning ensures a service or app will only trust a specific certificate or public key. SSL inspection breaks this trust because it alters the certificate chain. This affects:

- iOS/macOS updates
- App Store and iCloud
- Apple Maps, FaceTime, and more

🔗 [Learn more: Zscaler Certificate Pinning and SSL Inspection](https://help.zscaler.com/unified/certificate-pinning-and-ssl-inspection)

---

#### Recommended Steps

### 1. Bypass SSL Inspection for Apple Domains

**To prevent errors with Apple services that use pinning, configure SSL inspection bypass:**

- Go to: **Policy \> SSL Inspection \> SSL Inspection Policy Control**
- Add bypass rules for Apple-related domains.

**Common Apple domains to bypass:**

`*.apple.com *.icloud.com *.itunes.apple.com *.api.apple-cloudkit.com`

> Tip: Use traffic logs to discover additional domains affected by pinning.

---

### 2. Deploy Zscaler Root Certificate (For Non-Pinned Services)

For Apple services **not using certificate pinning**, you can safely inspect SSL traffic if the Zscaler root certificate is trusted by the user’s device:

- Install the **Zscaler Root CA** on all endpoints.
- Ensure it’s placed in both the **system** and **browser trust stores**.

---

### 3. Use Zscaler Client Connector with Policy-Based Exceptions

If using **Zscaler Client Connector**:

- Ensure SSL inspection is correctly enabled in the app’s profile.
- Use policy-based domain exclusions for Apple-pinned traffic only.

---

#### Best Practices

- **Limit bypass scope**: Only exclude domains you’ve confirmed are impacted.
- **Log and monitor**: Use traffic logs or packet captures to identify handshake failures.
- **Stay updated**: Regularly check Zscaler Help and Community for Apple-related updates.

---

#### Deployment Guidance: MSSP vs. Standard Projects

SecureDynamics generally applies these types of SSL inspection bypass rules **only as part of our MSSP (Managed Security Services Provider) program**.

For customers going through a **standard Zscaler deployment**, we recommend:

- Thoroughly reviewing the content of this KB article
- Using it as a reference to define which Apple services should be bypassed
- Working with your assigned **Zscaler deployment engineer** and/or **education specialist** to: 
    - Understand SSL inspection behavior
    - Learn how to apply, test, and maintain these policies within your own environment

This approach empowers your internal team to confidently manage SSL exceptions and customize them as needed over time.

---

#### Summary

Apple’s use of certificate pinning requires thoughtful configuration of SSL inspection. By **bypassing only the necessary domains**, **deploying certificates properly**, and **leveraging Client Connector**, you can ensure seamless Apple service access while maintaining robust security.

 

- [FAQs](https://securedynamics.net/kb/faqs?hsLang=en)
- [Troubleshooting](https://securedynamics.net/kb/troubleshooting?hsLang=en#main-content)

    - [Client Connector Portal](https://securedynamics.net/kb/troubleshooting?hsLang=en#client-connector-portal)
    - [Zscaler Client Connector](https://securedynamics.net/kb/troubleshooting?hsLang=en#zscaler-client-connector)
- [Support](https://securedynamics.net/kb/support?hsLang=en)
- [SecureDynamics Internal](https://securedynamics.net/kb/securedynamics-internal?hsLang=en)
- [Licensing](https://securedynamics.net/kb/licensing?hsLang=en#main-content)

    - [ZIA Upgrades](https://securedynamics.net/kb/licensing?hsLang=en#zia-upgrades)
- [Education & Training](https://securedynamics.net/kb/education-training?hsLang=en)
- [Delivery Services](https://securedynamics.net/kb/delivery-services?hsLang=en)
- [Partner Help](https://securedynamics.net/kb/partner-help?hsLang=en)

[![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png "SecureDynamics Zscaler Logo")](https://cm360.securedynamics.net?hsLang=en)

securedynamics.net Help Center

Copyright © 2026, SecureDynamics

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securedynamics.net/#organization",
  "@type" : "Organization",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "US",
    "addressLocality" : "Santa Clara",
    "addressRegion" : "CA",
    "postalCode" : "95054",
    "streetAddress" : "5201 Great America Pkwy, Suite 320"
  },
  "logo" : {
    "@type" : "ImageObject",
    "url" : "https://securedynamics.net/hubfs/SecureDynamics%20Zscaler%20Logo-1.webp"
  },
  "name" : "SecureDynamics",
  "sameAs" : [ "https://www.linkedin.com/company/3626024/" ],
  "url" : "https://securedynamics.net/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securedynamics.net/#website",
  "@type" : "WebSite",
  "inLanguage" : "en-US",
  "name" : "SecureDynamics",
  "potentialAction" : {
    "@type" : "SearchAction",
    "query-input" : "required name=search_term_string",
    "target" : {
      "@type" : "EntryPoint",
      "urlTemplate" : "https://securedynamics.net/hs-search-results?q={search_term_string}"
    }
  },
  "publisher" : {
    "@id" : "https://securedynamics.net/#organization"
  },
  "url" : "https://securedynamics.net/"
}
```