App Connector and ZPA cloud service is attempting a SSL interception

 ZPA does not support SSL interceptions. ZPA uses TLS connections and pinned certificates, so a device performing SSL interception will cause the connection to fail between the App Connector and the Zscaler Cloud.

To make sure traffic is not SSL intercepted, you need to allowlist all the ZPA domains or IP addresses that are listed on config.zscaler.com/private.zscaler.com/zpa in the SSL interception device. This ensures App Connectors and the Zscaler URLs (e.g., *.zpath.net, *.zscaler.com) are bypassed from a SSL inspection.