Radar ·
Private CA roots used for TLS inspection may issue certificates without transparency log entries
An author claims that TLS inspection roots installed on corporate laptops can issue certificates for any site without appearing in certificate transparency logs, since browsers require that only of publicly trusted CAs. The source gives no links.
According to the briefing dated 22 October 2026, private certificate authority roots, such as the one used by Zscaler TLS inspection products, installed on corporate laptops, may be able to issue certificates for any site. Those certificates would not need to be recorded in public certificate transparency logs, because browsers require that only of publicly trusted CAs. The author describes this as a real trust gap: locally installed roots could impersonate domains without leaving traces visible outside the organization. The text mentions relevance to threat models, but it presents no tests, measurements, affected versions or vendor responses.
The source contains no links, primary sources or verifiable data. To consult the material, look for the author's original publication and for browser policy documents on certificate transparency. To assess risk in your environment, check which private roots are installed on your devices and who can change the trust store. This item is a factual summary of a claim, not a technical validation of it.
Original source: Raízes de CA privadas como a da Zscaler podem emitir certificados sem log