Skip to content

Engineering resources / Zscaler ZIA

SSL bypass templates.
Ready to reference. Easy to copy.

Explore the SecureDynamics baseline lists for Certificate Pinned applications, Apple, and Microsoft. Copy the entries you need for your own custom URL categories.

3 maintained categories528 entriesSnapshot refreshed: 2026-09-11 18:38 UTC

Ready for your custom URL category

Full list of FQDNs and leading-dot wildcards for this tab, one per line. No IP addresses, headers, or extra columns. Search and entry-type filters do not affect these exports.

CSV is for spreadsheet reference, not direct Zscaler import. Open it in Excel or Google Sheets, then copy only the FQDN/domain entries (without the header or other columns) and paste them into Zscaler. For direct import, use the TXT download above: one entry per line, with no commas.

Certificate Pinned SSL bypass template
Domain / IP addressTypeRetain parent categoryCopy
.acrobat.comWildcardYes
.echosign.comWildcardYes
.echocdn.comWildcardYes
.bam.nr-data.netWildcardYes
.newrelic.comWildcardYes
platformdl.adobe.comFQDNYes
fpdownload.adobe.comFQDNYes
sstats.adobe.comFQDNYes
get3.adobe.comFQDNYes
get.adobe.comFQDNYes
stats.adobe.comFQDNYes
dlmping3.adobe.comFQDNYes
dlmping2.adobe.comFQDNYes
.amazonworkspaces.comWildcardYes
.cloudfront.netWildcardYes
akadns.netFQDNYes
connectivitycheck.gstatic.comFQDNYes
cros-omahaproxy.appspot.comFQDNYes
omahaproxy.appspot.comFQDNYes
ssl.gstatic.comFQDNYes
tools.google.comFQDNYes
pack.google.comFQDNYes
.appspot.comWildcardYes
.video.google.comWildcardYes
.gvt1.comWildcardYes
.gvt2.comWildcardYes
.adobelogin.comWildcardYes
.alpinelinux.orgWildcardYes
.ariba.comWildcardYes
.browser-intake-datadoghq.comWildcardYes
.chime.awsWildcardYes
.cloud.ariba.comWildcardYes
.cloudsink.netWildcardYes
.cmds-tachyon.comWildcardYes
.crowdstrike.comWildcardYes
.cursor.comWildcardYes
.cursor.shWildcardYes
.datadoghq.comWildcardYes
.docker.ioWildcardYes
.fathom.videoWildcardYes
.getgo.comWildcardYes
.github.comWildcardYes
.gotoassist.comWildcardYes
.hyatt.comWildcardYes
.jamfcloud.comWildcardYes
.launchdarkly.comWildcardYes
.meet.google.comWildcardYes
.mimecast.comWildcardYes
.mongodb.comWildcardYes
.mtalk.google.comWildcardYes
.ninjaone.comWildcardYes
.ninjarmm.comWildcardYes
.ninjarmm.netWildcardYes
.npmjs.orgWildcardYes
.okta-emea.comWildcardYes
.okta.comWildcardYes
.oktacdn.comWildcardYes
.oktapreview.comWildcardYes
.pypi.orgWildcardYes
.pythonhosted.orgWildcardYes
.remotedesktop.google.comWildcardYes
.rmmservice.comWildcardYes
.rmmservices.netWildcardYes
.salesforce.comWildcardYes
.screenconnect.comWildcardYes
.sentry.ioWildcardYes
.slack.comWildcardYes
.speedtest.netWildcardYes
.splashtop.comWildcardYes
.transmitsecurity.ioWildcardYes
.zoom.usWildcardYes
bridge.claudeusercontent.comFQDNYes
dl-cdn.alpinelinux.orgFQDNYes
download.docker.comFQDNYes
files.pythonhosted.orgFQDNYes
idam.breachlocklabs.comFQDNYes
instantmessaging-pa.clients6.google.comFQDNYes
raw.githubusercontent.comFQDNYes
registry.npmjs.orgFQDNYes
registry.yarnpkg.comFQDNYes
repo.maven.apache.orgFQDNYes
safebrowsing.google.comFQDNYes
sensor.cloud.tenable.comFQDNYes
statsig.anthropic.comFQDNYes
urldefense.proofpoint.comFQDNYes
api.ninjarmm.comFQDNYes

These templates build upon the guidance and application information Zscaler has long provided in Certificate Pinning and SSL/TLS Inspection. SecureDynamics extends that foundation with crowdsourced findings from our large number of ZIA deployments, with engineers reviewing and maintaining the shared baseline.

Use the list in your configuration

  1. Choose a category and review the entries for your environment.
  2. Copy the entire category, domains, IPs, or your search results. Each entry is copied on its own line.
  3. Use the TXT download or paste the copied entries into your custom URL category in ZIA. The CSV is a spreadsheet reference with “Retain Parent Category” values; do not import the CSV directly.
  4. Review the associated SSL inspection policy and test the change before wider rollout.

Understand what you’re copying

app.example.com identifies a specific host. A leading dot, such as .domain.org, includes the named domain and subdomains. Use a leading dot, not *.domain.org.

The Apple template includes 19 domains and 380 IPv4 entries in this snapshot. IPs are preserved as individual addresses; no network ranges are inferred. Copy controls keep domains and IPs available separately.

These are maintained baseline templates. Bypassing SSL inspection reduces visibility into encrypted traffic. Review broad wildcards and apply entries only where required.

Zscaler URL format guidelines ↗

Help improve the baseline

Suggest a domain

Found an application that needs an exception? Tell our engineers which domains are involved and why they belong in the template.

Use lowercase FQDNs or leading-dot wildcards, one per line. Include the affected application and supporting vendor guidance where available.

Suggestions enter a separate engineering review queue during the daily refresh. They do not automatically update the lists and are not support cases with a response SLA.

By submitting, you allow SecureDynamics to use these details to review your suggestion and contact you about it. See our Privacy Policy.

Loading suggestion form…

Lists are refreshed daily from the engineer-maintained source spreadsheet. This page serves a saved snapshot; viewing it does not query Google Sheets. SecureDynamics maintains these templates independently of Zscaler.