The Zscaler software architecture is engineered to minimize exposure of the private keys as well as the SSL intercepted data collected during SSL inspection. The keys and data are kept secure through all phases:

• Key Generation

  When the administrator of an organization requests a CSR for an intermediate Central Authority (CA), the Zscaler CA generates a 2048-bit private and public key pair. The private key is immediately encrypted with AES encryption using a password. When an Internet & SaaS Public Service Edge requests the private key for SSL inspection it uses this same algorithm to decrypt the private key, as explained in Key Distribution. This ensures that the private key password isn't transmitted or stored on disk on any system; it's stored in the system’s memory only.

  The CA encrypts the private key and stores it in an SQL database that contains your organization’s policies. The SQL database is accessible only to your organization by logging in with authorized admin credentials. Any write operation to the CA database is immediately replicated to two other identical CA servers in physically separate locations in the US for rapid disaster recovery. The keys are never in the decrypted state on the CA server once encrypted.

  Close
• Key Distribution

  When a user from your organization tries to access a site that uses HTTPS/SSL, the Internet & SaaS Public Service Edge requests your organization’s key pair from the CA. The CA sends the key pair over a 2048-bit TLS connection to the Internet & SaaS Public Service Edge, along with your organization’s intermediate certificate. The CA sends the key pair and certificate only to the requesting Internet & SaaS Public Service Edge.

  If a location’s traffic is sent to an organization’s private Internet & SaaS Public Service Edge only, then the CA sends the private key to the private Internet & SaaS Public Service Edges only. It does not send the organization’s keys and intermediate certificate to public Internet & SaaS Public Service Edges in the Zscaler cloud.

  The Internet & SaaS Public Service Edge maintains the private key unencrypted in its RAM in order to generate certificates for the websites that the user visits. These certificates are dynamically generated each time in RAM and not stored in any storage medium.

  Additionally, the Internet & SaaS Public Service Edge caches the intermediate certificate that it received from the CA, until it receives a new intermediate certificate from the CA. Your organization sets the expiration date for the certificate and can revoke it at any time. Administrators cannot use the intermediate certificate issued to Zscaler to sign any other certificate because the private key never leaves the Zscaler CA or Internet & SaaS Public Service Edge.

  If all CA servers in a cluster are not available due to a catastrophic event and the Internet & SaaS Public Service Edges are still active, the Internet & SaaS Public Service Edges continue to perform SSL inspection as long as an organization’s policies, certificates and keys already reside in the Internet & SaaS Public Service Edge’s memory. If an Internet & SaaS Public Service Edge does not have the policy and keys for an organization, then the Internet & SaaS Public Service Edge won't decrypt the SSL traffic. In the unlikely event that both the CA and Internet & SaaS Public Service Edge are not available, the Zscaler service supports a proxy bypass capability where all traffic is allowed without protection.

  Close
• Key Deletion

  An Internet & SaaS Public Service Edge allocates memory from a special region for all SSL operations. This region of memory is always zeroed out as soon as the memory is released. This applies to packet buffers as well as key storage areas. An Internet & SaaS Public Service Edge also does not allow a data dump from this area from the command line. All data is zeroed out if a process core must be dumped due to a software error. Due to these precautions, the Zscaler cloud is invulnerable to SSL Heartbleed attacks.

  The CA sends SSL keys only to the Internet & SaaS Public Service Edges that process your organization’s traffic. They are only ephemerally present in the Internet & SaaS Public Service Edge RAM and are zeroed out of RAM after they are unused for a short period of time.

  Once a new intermediate certificate is generated, a new key is generated as well. The old key and intermediate certificate are removed from the database as well as the database backup.

  Zscaler takes your organization's security and privacy seriously and strives to ensure your data is securely handled. Zscaler audits its security designs regularly to ensure it meets the highest level of security standards possible.

  Zscaler operation processes and its Information Security Management System (ISMS) are ISO 27001 and SOC 2 Type II certified. All Internet & SaaS Public Service Edges and CAs are monitored for 24 hours. Access to the CA and Internet & SaaS Public Service Edges is highly restricted and controlled.

  Close