Private CA roots can issue certificates without transparency log entries
The post claims that TLS inspection roots installed on corporate laptops can issue certificates for any domain without appearing in certificate transparency logs, a trust gap that calls for local monitoring.
Source: Raízes de CA privadas como a da Zscaler podem emitir certificados sem log (x.com). Text prepared with AI from this source.
What happened and what to do
The author describes how TLS inspection roots installed on corporate laptops, such as those used by Zscaler-style solutions, could issue certificates for any website. Because browsers only require certificate transparency logging from publicly trusted authorities, these locally issued certificates would leave no trace in those logs. According to the post, this creates a real gap for threat models, since locally installed roots could impersonate domains without leaving public evidence.
In practice, a company could treat inspection roots as sensitive assets: inventory the CAs present on managed endpoints, alert on new or unauthorized installations, and use name constraints to restrict which domains each inspection CA may issue for. It also makes sense to record issuance from internal CAs in a private log and correlate it with endpoint and proxy telemetry, and to evaluate certificate pinning for critical services. This calls for collection and monitoring pipelines under the organization's own control.
How the consultancy can help
Diagnosis of trust roots and inspection CAs on endpoints, covering inventory, name constraint review and design of issuance monitoring, implemented on the client's own infrastructure.
Next step
Send a short description of your environment, including your TLS inspection setup and laptop management, and receive a scoped proposal from Wendelmaques.
Let's assess your project
I reply with scope and a proposal.