SSL Certificate Issue with DDEV on Docker Desktop (WSL2) behind Zscaler Proxy

Docker Desktop
,
3

Thank you for your questions. Here are my answers and additional test results:

  1. Did you confirm that the rejected SSL cert was from Zscaler?
    Yes. I ran:

zscaler test
zscaler test2555×1087 111 KB

So Zscaler is intercepting SSL traffic, but the container does not trust Zscaler CA.

  1. Are you sure you built the new image and not used something from cache?

    Yes. I ran:

    ddev restart --stop --remove-data --force-build
    This forces a fresh build of the web container.

  2. If you know you built the image, have you checked that the CA was actually added to the CA bundle file?

    Yes, I checked inside the container:

    grep -i “Zscaler” /etc/ssl/certs/ca-certificates.crt

    Result: Giving nothing that means “Zscaler not found in CA bundle” i think

So the CA was not successfully added to the system bundle may be. This means the Zscaler root certificate was never added to the system CA bundle inside the container, so PHP, Composer, and cURL cannot validate Zscaler-intercepted SSL connections.

  1. Are you sure the rejected SSL is still Zscaler?

    Yes. All HTTPS requests (packagist.org, docker.io) fail with curl error 60, and openssl confirms Zscaler in the chain.

Additional tests:

  • PHP/OpenSSL CA path:

    openssl.cafile= (empty)
    openssl.capath= (empty)

    So PHP and Composer rely on the system CA bundle.

  • Composer diagnose:

    All HTTPS checks fail with curl error 60.

Behavior comparison:

  • On a non-corporate laptop (no Zscaler), everything works fine.
  • If I disable Zscaler Client Connector on my corporate laptop, the issue disappears.
  • The problem only occurs when Zscaler is active, which is mandatory for corporate network access.

Root cause:

This is not a DDEV issue—DDEV only orchestrates Docker. The problem is CA trust inside the container I think. May be the container does not trust Zscaler CA because it is missing from /etc/ssl/certs/ca-certificates.crt. I think PHP and Composer use this system CA bundle, so all HTTPS requests fail. Manual changes inside the container (like adding the cert) are lost after ddev restart because containers are rebuilt. The CA must be added during the image build process or via persistent configuration.

Could you please suggest the best practices for managing CA trust in Docker-based environments behind Zscaler? I have tried multiple approaches (manual certificate addition, update-ca-certificates, custom configuration), but none have worked consistently. Any recommended steps or official guidance would be greatly appreciate