A macOS desktop application connecting to api.

Option D applies the narrow exception required by certificate pinning while retaining inspection elsewhere. A pinned application rejects the substitute certificate presented during SSL/TLS Inspection, so Zscaler recommends exempting the affected cloud application or its individual domains, which can be grouped in a custom URL category. Zscaler’s certificate-pinning guidance documents this approach. QUIC uses UDP and does not provide the TCP session information required for normal Zscaler SSL/TLS Inspection. Zscaler’s QUIC management guidance recommends blocking QUIC so applications fall back to TCP. ZPA application segments are for private applications and do not repair a public SaaS TLS handshake. A user-agent exception across all destinations is unnecessarily broad. A trusted-network bypass would remove protection for unrelated corporate traffic and would still leave roaming behavior inconsistent.

================