Zscaler is pure crap, we use it at work too. It's especially hard to configure docker containers for its proxy settings and ssl certificate.
When I test something new in our lab I spend 10 minutes installing it and half a day configuring the proxy.
When I test something new in our lab I spend 10 minutes installing it and half a day configuring the proxy.
It also breaks a lot of web pages by redirecting HTTP requests in order to authenticate you (CSP broken). Teams GIFs and GitHub images have been broken for months now and no one cares.
We use an external auth provider which makes even more complex config yeah.
You can open the Teams developer tools to check this. Click the taskbar icon 7 times, then right click it. Use dev tools for select web contents, choose experience renderer AAD. Search for GIFs in Teams and monitor the network tab
Well, at least they tried I guess.
"http.ssl.insecure=true"
Is not a fix under any circumstance.
And if they don't really care about security, why should you?
In terms of better solutions, I would prefer a completely different approach. Securing the endpoint instead of the network. Basically the idea of Google's "BeyondCorp".
What happens now is that people just turn off their VPN and Zscaler client to avoid issues, when they're working from a public hotspot or at home. In the office (our lab environment) we unfortunately don't have that option.
But by doing so they leave themselves much more exposed than when we didn't have Zscaler at all.