SSL Handshake Exception due to ZScaler

[lucaspeixotoac]

Hi,

Eca works perfectly in my home computer, but in my company computer that has Zscaler, there is always a SSL Handshake error as you can see in the image below:

Zscaler works by intercepting all traffic—internet, cloud, and private applications—and routing it through its cloud-based security platform before it reaches its destination.

As GPTEL and other packages works normally, I believe I could do something in the ECA end to fix that, like I don't know, ignoring certificate checks? I'm not sure, but how could you help me on that?

My emacs version is 30.1 and I'm using eca in the below version:

As far as I understand, the ECA binary is rejecting the ZScaler certificate because it is not from a valid CA trust. I would need to include the ZScaler certificates CA root in the ECA bundle. This sounds odd to me, if there was like a flag to ingore certificate checks, I don't know.

[ericdallo]

@lucaspeixotoac That's a good quesiton, I work in a company where we use zscaler and works smoothly with no changes, not sure it's a eca issue to be honest, ECA just do normal HTTP requests using hato Clojure library.

There is a option to set a proxy in ECA for http requests but I doubt it would fix your issue

[CsBigDataHub]

@lucaspeixotoac we use Zscaler at work too, I ran in to the same issue a while back. See editor-code-assistant/eca#125.

What version of ECA are you using? are you building eca yourself?

[lucaspeixotoac]

@CsBigDataHub
I'm using eca version 0.78.2 and is not built by me, when I run eca command the executable is downloaded and executed by emacs.

This is my java version:

java --version
openjdk 17.0.17-ea 2025-10-21
OpenJDK Runtime Environment (build 17.0.17-ea+5-Debian-1)
OpenJDK 64-Bit Server VM (build 17.0.17-ea+5-Debian-1, mixed mode, sharing)

Were you building ECA yourself?

[lucaspeixotoac]

I have tried to add the zscaler root certificate in my java keystore, but keep failing:

keytool -list -keystore $JAVA_HOME/lib/security/cacerts | grep zscaler
Warning: use -cacerts option to access cacerts keystore
Enter keystore password:  ****
zscaler-root, Nov 13, 2025, trustedCertEntry,

[ericdallo]

That's weird, if you are using the compiled binary (downloaded by plugins automatically), you are not using JVM so that's not the issue.
That must be something related with how hato.client does the requests, but I have no idea how we can understand what's going on

[CsBigDataHub]

Try these and lets me know if it works

This is an example with openai

1. Add Zscaler Certificate to Java Truststore

Export the Zscaler root certificate and add it to the JVM's truststore:

# Export the Zscaler certificate
echo | openssl s_client -servername api.openai.com -connect api.openai.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > zscaler-root.crt

# Find Java's keystore location (usually JAVA_HOME/lib/security/cacerts)
keytool -import -alias zscaler -file zscaler-root.crt -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit

2. Bypass SSL Verification (Quick Workaround - Not Recommended)

Set the environment variable before starting ECA:

export JAVA_OPTS="-Dcom.sun.jndi.ldap.connect.pool=false -Dhttps.protocols=TLSv1.2"

[CsBigDataHub]

Also you can try this

eca -Djavax.net.ssl.trustStore=/path/to/my-truststore.jks -Djavax.net.ssl.trustStorePassword=changeit server