Enabling TLS for Zscaler ZPA LSS Log Streaming to the CCE

Table of Contents

• Overview
• Prerequisites
• Responsibilities
• Configuration Steps
  • Step 1: Generate a CSR in ZPA
  • Step 2: Send the CSR to ARIA Technical Support
  • Step 3: Receive the Signed Files
  • Step 4: Upload the Signed Certificate and Chain
  • Step 5: Create a New App Connector Group and Provisioning Key
  • Step 6: Deploy the Dedicated App Connectors
  • Step 7: ARIA Technical Support Installs the New CCE Certificate
  • Step 8: Update the Log Receivers and Enable TLS
• Troubleshooting
• Verification (MSSP Only)

Overview

This article explains how to enable TLS encryption for Zscaler Private Access (ZPA) Log Streaming Service (LSS) logs sent to the ADR CCE (Collection and Control Engine).

ZPA App Connectors deliver LSS logs. When TLS is enabled on a Log Receiver, the App Connector only trusts a server certificate that chains to its own Enrollment (CA) Certificate. ZPA has no separate place to add a trusted CA for log receivers, so a self-signed CCE certificate is rejected and log delivery stops.

The supported approach, confirmed by Zscaler Support, is:

1. ZPA generates a Certificate Signing Request (CSR) for a new enrollment certificate.
2. ARIA Technical Support signs the CSR with a private root CA and returns it.
3. You enroll a small set of dedicated App Connectors under that enrollment certificate.
4. The CCE presents a server certificate issued by the same private root CA, so those App Connectors trust it.

Your existing App Connectors and application access are not affected. They stay on their current enrollment certificate.

Prerequisites

Before starting, ensure:

• ZPA administrator access, with permission to manage enrollment certificates, App Connector groups, provisioning keys, and Log Receivers.
• An existing ZPA LSS integration to the CCE. See Device Integration: Zscaler ZPA/LSS Syslog SIEM Integration.
• TLS enabled on the CCE syslog listener. See Configure TCP over TLS Log Forwarding to the CCE. Note that the self-signed certificate created in that article is not sufficient for ZPA. ARIA Technical Support will provide a replacement certificate as part of this process.
• The ability to deploy new App Connector VMs, with network access to the CCE on the TLS syslog port (TCP 514 by default).

Responsibilities

Configuration Steps

Step 1: Generate a CSR in ZPA

1. In the Zscaler Admin Console, go to Infrastructure > Private Access > Component > Enrollment Certificates. In older ZPA portals, go to Administration > Certificates > Enrollment Certificates.
2. Create a new Certificate Signing Request (CSR) for an enrollment certificate, and give it a descriptive name (for example, ADR LSS Enrollment).
3. Download the CSR file.

Do not use Generate Certificate. That option creates a certificate signed by a Zscaler CA, which will not chain to the ADR root CA.

ZPA keeps the private key for the CSR. Nothing secret leaves your tenant.

Zscaler reference: Creating Certificate Signing Requests for Enrollment (CA) Certificates

Step 2: Send the CSR to ARIA Technical Support

Send the CSR file to ARIA Technical Support. If you do not have an open case, contact support. A CSR is not sensitive and can be sent by email or attached to the case.

Step 3: Receive the Signed Files

ARIA Technical Support returns the following files:

ARIA Technical Support also provides the SHA-256 fingerprint of the root CA. Confirm it matches the file you received before uploading it:

openssl x509 -in <root-ca-file> -noout -fingerprint -sha256

Step 4: Upload the Signed Certificate and Chain

1. Return to Enrollment Certificates (same location as Step 1) and open the CSR created in Step 1.
2. Upload the signed enrollment certificate.
3. Use Upload Certificate Chain to upload the root CA certificate.

Zscaler reference: Uploading Enrollment (CA) Certificates and the Certificate Chain

Step 5: Create a New App Connector Group and Provisioning Key

1. Create a new App Connector Group (for example, ADR LSS Connectors).
2. Create a new App Connector provisioning key for that group, and select the enrollment certificate from Step 4 as its signing certificate.

Zscaler reference: Configuring App Connector Provisioning Keys

Step 6: Deploy the Dedicated App Connectors

1. Deploy new App Connector VMs using the provisioning key from Step 5. At least two are recommended for redundancy.
2. Confirm the App Connectors show as connected in the Zscaler Admin Console.
3. Allow the App Connectors to reach the CCE on the TLS syslog port through any firewalls or security groups.

These App Connectors must be newly deployed. An App Connector's trust is set when it enrolls, so existing App Connectors cannot be moved to the new enrollment certificate.

Step 7: ARIA Technical Support Installs the New CCE Certificate

When Steps 1 to 6 are complete, notify ARIA Technical Support. ARIA Technical Support installs a new server certificate on the CCE, issued by the same private root CA, and confirms when it is ready.

Wait for this confirmation before Step 8. If TLS is enabled before the CCE presents the new certificate, log delivery stops until it does.

Step 8: Update the Log Receivers and Enable TLS

For each Log Receiver that sends to the CCE:

1. Go to Logs > Log Streaming > Log Receivers and click Edit.
2. Set App Connector Group to the group created in Step 5, and remove any other groups.
3. Keep the host and port unchanged. The host must match the address the CCE certificate was issued for (IP address or DNS name). If you need to change it, contact support so the certificate can be reissued.
4. Enable TLS Encryption.
5. Save.

Troubleshooting

If logs stop after enabling TLS, check the dedicated App Connectors' logs for TLS errors and share them with ARIA Technical Support. Common causes:

• Unknown CA: the Log Receiver is assigned to an App Connector group that was not enrolled with the new enrollment certificate, or the CCE is still presenting its old certificate.
• Certificate name mismatch: the Log Receiver host does not match the address in the CCE certificate.
• Connection refused or timed out: the App Connectors cannot reach the CCE on the TLS syslog port.

To test the TLS handshake from an LSS App Connector (requires shell access and the root CA file from Step 3):

openssl s_client -connect <CCE-address>:514 -showcerts \
  -CAfile <root-ca-file> -verify_ip <CCE-address> </dev/null

If the CCE is addressed by DNS name, replace -verify_ip with -verify_hostname. A working setup shows two certificates in the chain and Verify return code: 0 (ok).

Verification (MSSP Only)

In the ADR dashboard, confirm that ZPA LSS logs from each Log Receiver are arriving after TLS is enabled.