Disable ZScaler temporarily on your Mac (2025 update)
If you are using a corporate machine with Zscaler installed on it, you may face SSL handshake errors, especially with Java apps throwing up javax.net.ssl.SSLHandshakeException errors when getting certificates proxied by Zscaler instead of the original certificates. Zscaler also caused issues when I tried to enable Wireless@SGx connectivity setup on the Mac. Therefore, it is useful to be able to disable Zscaler client temporarily. However, most corporate MDM policies takes away the capability for you to disable the Zscaler client from its UI.
Disable ZScaler Client
Before I start, a short disclaimer. Do this at your own risk. If you’re not sure why you are doing this, don’t.
1. Unload the ZScaler services
Open up Terminal (or iTerm2) and use the following command to unload the Zscaler services. This will require your user id to have administrator rights. If you don’t, then unfortunately you are out of luck in trying to disable Zscaler on your machine. There are two (5) zscaler services that you need to unload to disable Zscaler client temporarily. The command below unloads them all in a few lines.
# kill the zscaler client launchctl unload /Library/LaunchAgents/com.zscaler.preloginui.plist && launchctl unload /Library/LaunchAgents/com.zscaler.tray.plist # kill the zscaler services sudo launchctl unload /Library/LaunchDaemons/com.zscaler.service.plist && sudo launchctl unload /Library/LaunchDaemons/com.zscaler.tunnel.plist && sudo launchctl unload /Library/LaunchDaemons/com.zscaler.UPMServiceController.plist
The command should not display any output and will temporarily unload the ZScaler service until you manually load the service again, or restart your Mac. If the service has already been disabled, you will see an error stating that it cannot find the service.
Note that I have an error above. That’s becuase I’ve already kept the Zscaler’s tunnel extension service disabled. You can find this in the Settings -> Login Items & Extensions. Look for Zscaler and click on the ⓘ icon.
Want to get the same terminal experience as you see in the screenshot above? Check out my macOS set up for coding guide here now!
Once you have done that, you should see that Zscaler service is now temporarily disabled.
3. Check the certificates to confirm Zscaler is temporarily disabled
You can easily check if your internet traffic is still being proxied through Zscaler or not. Open up Safari and load up google.com (or any other websites for that matter) and check the certificate. When Zscaler is enabled, you would see that the certificate will have is one that is generated by Zscaler.
But when you disable Zscaler successfully, you will see the original certificates again.
Re-enabling Zscaler
To re-enable Zscaler, just reopen the Zscaler client and reload the Zscaler service using the following command. You should see Zscaler running back up again as it was.
# reopen the zscaler client open -a /Applications/Zscaler/Zscaler.app --hide # reload the zscaler services sudo launchctl load /Library/LaunchDaemons/com.zscaler.service.plist && sudo launchctl load /Library/LaunchDaemons/com.zscaler.tunnel.plist && sudo launchctl load /Library/LaunchDaemons/com.zscaler.UPMServiceController.plist
If this post has been useful, support me by buying me a latte or two 🙂
this works nice, however the name resolution doesn’t work after disable.
I had this issue once. I needed to restart my Mac for it to get working again.
It doesn’t work anymore 🙁
Unload failed: 5: Input/output error
Try running `launchctl bootout` as root for richer errors.
Unload failed: 5: Input/output error
Try running `launchctl bootout` as root for richer errors.
I just tried on my machine and it still works. The command will error out if the service is already unloaded.
You can also try to check if the service is still at the same location.
ls /Library/LaunchDaemons/com.zscaler.service.plistIf it’s there and the service is currently running, the command should unload the service properly.
The thing is, I could disable the Zscaler by using the command – so it works one-off.
But then, when I wanted to enable it back again – the command doesn’t work and sometimes the laptop needs to restart multiple times in order to get the Zscaler to start working and assigning the right IP to the workstation.
Any possible workaround?