zia-create-ssl-inspection-rule
Create a ZIA SSL Inspection rule that controls how Zscaler handles SSL/TLS encrypted traffic — BLOCK (drop the SSL connection), DECRYPT (decrypt and inspect), or DO_NOT_DECRYPT (pass through without decryption). Scopes the rule by cloud applications, URL categories, users, groups, departments, locations, device trust levels, platforms, source/destination IP groups, and ZPA application segments. SSL Inspection rules do NOT support a recurring time-of-day schedule — for time-of-day enforcement, use a different rule type (Cloud Firewall Filtering, URL Filtering, etc.). Use when an admin asks to 'create an SSL inspection rule', 'do not decrypt traffic to X', 'decrypt SSL for Y', 'block SSL for Z', or 'add an SSL bypass exception'. For pure auditing of existing SSL bypass posture, see `zia-audit-ssl-inspection-bypass` (read-only).
Install
With your agent
Install OMGSkills skill "zscaler/zscaler-mcp-server:skills/zia/create-ssl-inspection-rule" into this agent's normal skills directory: use the OMGSkills MCP get_skill tool, install only the pinned_install commit and path, verify SKILL.md against pinned_install.skill_md_sha, and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zia/create-ssl-inspection-rule ~/.claude/skills/zia-create-ssl-inspection-ruleFrom README
ZIA: Create SSL Inspection Rule How to talk to the admin Don't narrate tool calls, JMESPath filters, search keys, or internal lookup logic. Just confirm what was created and which scoping was applied. Empty list responses are authoritative. If a zialist lookup returns no match for an exact-name search, treat the resource as "does not exist." Do not retry with split keywords or unfiltered listings. Don't claim a tool doesn't exist without checking. If ziacreate and ziaget are visible for a resource, the matching zialist exists too. Don't narrate strategy pivots. If you have to retry quietly, retry quietly and report only the final outcome. After every successful create, mention the activation step explicitly — ZIA changes are staged until activated. The agent must call ziaactivateconfiguration() and tell the admin the change is now live. Scope of this skill This skill creates one SSL Inspection rule per invocation.
More from this repo
cross-product-troubleshoot-user-connectivity
Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
easm-review-attack-surface
Used to review the organization's external attack surface using Zscaler EASM.
zcc-generate-logout-otp
Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.