Using Zscaler alongside Twingate

Last updated: October 27, 2026

Applicable to

  • Twingate Component: Client

  • Platform: Windows. Other platforms have not been confirmed or tested.

  • 3rd Party: Zscaler Client Connector.

Overview

Zscaler has been observed to intercept the Twingate TLS session, causing the Twingate Client to be unable to open secure channels with the invalid certificate being returned.

Symptoms

In Twingate.log on Windows devices you may see the below log snippets.

[WARN] [client] SSL check error from host: <twingate_network>.twingate.com. SSL Certificate is not pinned! [ApiCertificateValidationService.Callback]
[ERROR] [client] Failed to validate controller url [ControllerServerValidator.ValidateAsync] System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. 
   at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) 
   at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) 
   --- End of inner exception stack trace ---

Resolution

The Zscaler service on Windows devices runs even when not connected. For Twingate to work properly, Zscaler must either be uninstalled, or the Zscaler service must be stopped and disabled from running. Exiting the program is not sufficient.

In some cases it is possible for Twingate and Zscaler to run at the same time with the following configuration changes:

  1. In the Zscaler admin console, go to Administration → IP & FQDN Groups → Destination IPv4 Groups and create a group for SSL inspection bypass. Add the following to it: .twingate.com

  2. In the Zscaler admin console, under Policy → Zscaler Client Connector Portal → Windows, edit the applicable policy under HOSTNAME OR IP ADDRESS BYPASS FOR VPN GATEWAY and add the following as an exception, replacing <tenant> with your own tenant name: <tenant>.twingate.com

  3. Update the policy on the Zscaler local agent.

Other OS platforms have either not been confirmed or tested with compatibility. Should any issues be present on macOS or Linux, the resolution would be the same.