Skip to content
ZHERO Docs

SSL Inspection Coverage

Everything ZIA does to encrypted traffic depends on being able to read it. DLP, sandbox, URL filtering on HTTPS: they all sit on top of inspection, so the share of encrypted traffic you actually inspect is the number the rest of your posture rests on.

ZHERO measures it from your own web logs, puts it on the SSL Inspection page as a live figure, and keeps up to six months of it one click away.

Where it appears

Open the SSL Inspection policy page in your Zscaler console. ZHERO adds three controls stacked in the top right corner of the page, and enriches the policy table underneath.

ControlWhat it shows
First ringSSL Scan Enabled Locations Percentage, read from Zscaler’s own Security Policy Audit Report
Second ringThe qualified inspection rate ZHERO computes from the last 30 days of web logs
Chart buttonOpens the SSL Inspection Trend drawer, up to 180 days

Hovering the second ring opens Global SSL Inspection Statistics Details, the full finding behind the number: traffic totals per protocol, the bytes counted on each side of the ratio, and the daily breakdown.

The qualified rate, precisely

ZHERO asks Zscaler for 30 days of traffic broken down by protocol, up to the last completed day, and sorts the encrypted part into four buckets.

BucketCounted as
HTTPSInspected
Tunnel SSLInspected
DNS over HTTPSInspected
SSLNot inspected: encrypted traffic that passed through undecrypted

The rate is inspected bytes over encrypted bytes, with one deliberate correction: Office 365 traffic is removed from the denominator. Zscaler recommends bypassing those applications from inspection, and a tenant that follows the vendor’s own recommendation should not be scored down for it. Fifteen Microsoft application identifiers are treated this way, and only their plain SSL traffic counts, which is exactly the traffic knowingly passed through.

The uncorrected figure, everything encrypted over everything inspected, is computed too and appears in the details popover as the flat rate. The qualified rate is the one that matters, and it always sits at or above the flat one.

Two edge cases behave the way you would want. If all your encrypted traffic is Office 365, the rate reads 100%, because everything that could be inspected was legitimately bypassed. If no encrypted traffic flowed at all, it reads 0%.

What the number is worth

The same check drives the severity of the finding, on fixed bands:

Qualified rateSeverity
Above 75%Info
60% to 75%Low
50% to 60%Medium
30% to 50%High
30% or belowCritical

It also gates your ZIA posture score rather than just subtracting from it. A low inspection rate scales the whole ZIA contribution down, which is why the Global gauge can read lower than both ZIA and ZPA. The Security Posture Dashboard explains that mechanism and names the reduction in the caption under the gauge.

The 180-day trend

The rings answer “where are we now”. The chart button answers “where has this been heading”, which is the question that comes up the moment somebody asks whether last quarter’s cleanup worked.

The drawer opens on the last 60 days and extends 30 days at a time up to 180, from the Load 30 more days button. It loads progressively because the Zscaler report gets dramatically more expensive as the window grows: about 2 seconds for 30 days against roughly 97 for 180. ZHERO fetches six short windows in parallel instead, which covers the same six months in about 15 seconds and returns identical daily values.

Each block is fetched once and then cached. The windows sit on a fixed calendar grid rather than counting back from today, so a closed window is immutable history that stays cached, and only the most recent one expires daily. Reopening the drawer tomorrow re-fetches one block, not six.

Nothing is requested until you open the drawer. The page itself costs nothing.

Reading the chart

  • Qualified inspection rate, one point per day, the same formula as the ring.
  • Weekly average rate, the same rate folded per calendar week and weighted by bytes, drawn as steps. It is not the mean of the daily percentages: a quiet Sunday would otherwise count as much as a peak Tuesday. This is the line to read when you want to know whether something really moved.

Those two are visible on first paint. Four more are one click away in the legend, and they are the explanation rather than the answer:

  • Not inspected (SSL), the share that passed through undecrypted
  • Inspected (HTTPS), Inspected (Tunnel SSL) and Inspected (DNS over HTTPS), the three ways inspected traffic reaches you
  • Office 365 SSL (bypassed), a subset of the uninspected share, and the part excluded from the denominator

The four shares are per-day percentages of encrypted traffic and add up to 100%. Because the qualified rate excludes Office 365 from its denominator, it sits above the plain inspected share.

Drag across the chart to zoom into any period. The headline figure above the chart recomputes over the selection, a Zoomed tag appears, and Show all N days returns to the full window. A selection needs at least two days; anything shorter is treated as a click. Extending the history clears an active zoom, because loading older days shifts what the selected positions mean.

The drawer resizes by dragging its edge, like every other ZHERO drawer.

What the policy table gains

On the same page, ZHERO also works on the rules themselves:

  • Every non-default policy name becomes an entity, with the badge, the hover card and the drawer described in Getting Around ZHERO. The four Zscaler-managed defaults are left alone: Default SSL Inspection Rule, Zscaler Recommended Exemptions, Office 365 One Click and UCaaS One Click.
  • Criteria become entities too, so the URL categories and groups a rule references carry their own badges instead of being plain text.
  • Weak settings in the Action column are highlighted in severity colours as you scroll, without running an analysis: bypassing the other policies, allowing or passing through untrusted server certificates, OCSP revocation checking switched off, undecryptable traffic not blocked, and TLS 1.0 or 1.1 accepted as a minimum version.

The findings behind those colours, and the bypass rules worth narrowing, come from the SSL templates in the analysis templates catalog.

Requirements and limits

  • ZIA and Experience Center tenants. The check does not run on ZPA-only tenants.
  • The traffic analysis is an advanced template. Like every check that reads traffic logs, it is gated and may not be enabled on every tenant. Where it is not, the second ring does not appear; the first one, which comes from Zscaler’s report, still does.
  • It is a costly check. It re-runs on its own after 7 days, and a manual re-run is accepted once a day. The ring reads from the cached result, so opening the page does not trigger an analysis.
  • The window is fixed at 30 days for the ring and for the posture score. The drawer is the only place where the window changes, and it never feeds the score.
  • The trend drawer is recent. If the chart button is not on your page, your extension predates it; the changelog says which release added it.
  • If the traffic query fails, the second ring turns red and shows an exclamation mark, with the error in its tooltip.

FAQ

Why is my qualified rate so much higher than the plain inspected share? Because Office 365 is out of the denominator. If a large part of your encrypted traffic is Microsoft 365, removing it from the calculation lifts the rate substantially, and correctly so: that traffic is bypassed on Zscaler’s own recommendation.

Does DNS over HTTPS really count as inspected? Yes, when it arrives as the DNS over HTTPS protocol rather than as opaque SSL. Zscaler resolved it, so it was seen.

The trend says 180 days but I only see 60. That is the starting window. Use Load 30 more days as many times as you need; each press adds a month and the chart redraws as the block lands.

Why does the weekly line disagree with my own average of the daily values? The weekly value is weighted by bytes, not by day. It is the same formula the score uses, applied to a week of traffic rather than a day of it, which is why a busy Tuesday counts more than a quiet Sunday.

Can I export the trend? Not from the drawer. For the rules themselves, the SSL Inspection policy export carries the rule details with their traffic columns.

Does the drawer slow the console page down? No. Nothing is fetched until you open it, and each block of history is fetched once and cached.