Certificate failure with Zscaler

General Usage
1

My company has recently switched to using Zscaler
On my Windows laptop I use WSL

juliaup update

WARNING: cannot verify julialang-s3.julialang.org’s certificate, issued by ‘CN=Zscaler_Trust.xxx.com (t)\ ,OU=IT,O=XXX,ST=California,L=Santa Clara,C=US’:

Where the company is obfuscated slightly

Anyone else seen this?
I can wget the RELEASECHANNELDBVERSION file if I disable certificate checking

I am guessing Zscaler somehow spoofs certificates using its own certificates.
But for what reason?

2

Seemingly Zscaler does futz with certificates. The fix is semingly to import that certificate.

https://help.zscaler.com/zscaler-client-connector/uploading-custom-ssl-certificate-zscaler-client-connectorw

3

Yeah, zscaler is terrible MDM corporate crapware that mitms your SSL connections for compliance reasons. It does so by setting up a tun interface and mutilating your routing table.

I think it is safe to assume that your IT department rolled that out to you (because why else would you ever touch this with a 10-foot pole?). Theoretically they should have rolled out everything such that this works out of the box.

Practically speaking, zscaler breaks a lot of stuff. As a fellow sufferer:

  1. If you can get root on your machine, kill the process. Take no prisoners, do e.g. on macos launchctl unload /Library/LaunchAgents/com.zscaler.tray.plist && sudo launchctl unload /Library/LaunchDaemons/com.zscaler.service.plist && sudo launchctl unload Library/LaunchDaemons/com.zscaler.tunnel.plist. Don’t forget to write a good reason for that into the audit log.
  2. zscaler is necessarily not intercepting traffic in your local network (look at the routing table). Set up a SOCKS / ssh proxy on a machine in the same local network. This is the protip if zscaler decides to block the zscaler login and therefore all internet access. (lol, right?)
  3. in most configs, zscaler doesn’t intercept ssh traffic. Use socks via ssh proxies.
  4. Complain to your IT department. Continue complaining, telling them that this blocks your work. You NEED ipv6 unblocked, yadda yadda. You might get an exemption, or create enough workload that they end this policy.
  5. IT policy might have escape hatches like “oh, while you’re on the corporate VPN you don’t need zscaler active”. These are a godsent – just make sure you’re on the VPN.
  6. Look for a new job. I’m only half joking, a quarter crying, and a quarter looking for a place that respects my dignity enough not to MITM my SSL connections.

That being said, no idea about juliaup / zscaler specific interactions.

4

@foobar_lv2 Thankyou.
Setting up a SOCKS proxy is a good tip.

Looks like another fix is to download the Zscaler certificate and set WSL to trust it. This did not work for me, though I did not try too hard. I will give that method another try.

5

Theoretically your it department should have done that with the rollout / some kind of group policy thing.

Practically speaking, all kinds of software use all kinds configs with respect to root certificate store; some even have hardcoded certificate pinning.

And I emphasize with the impulse: If you’re juliaup, there is no reason to give honest achmed the power to pown all your users (implicitly: The jurisdiction where Honest Achmed resides also gets full access to MITM the software install. Access to a trusted root certificate can also come out of the barrel of a gun). Google used to be pretty hot on certificate pinning – super annoying if you want to MITM your own connections for security research.

So in practice zscaler is a support horror show. Do give a little push-back for the sake of all of us (if you’re in academia, you can give a lot more push-back than as a corporate drone; if you’re in natsec then you’re probably even more limited).

A quick search in the juliaup repo could not find any certificate pinning; but I’m not sure how the trust root set in juliaup is ultimately derived.

Regarding socks, consider Add SOCKS5 support · Issue #575 · JuliaLang/juliaup · GitHub

I think your (our :cry:) situation is similar as the linked issue (making juliaup work in iran); what we need is a command-line argument (or environment variable) that specifies a socks proxy and overrides system settings. Alas, there is no documentation regarding socks in the linked issue + pr.

Maybe you should open an issue. cc @davidanthoff because you added socks support to juliaup.