Added Zscaler root cert not used with build-tools (make)

[rhermsen]

After installing the Zscaler root certificate I'm able to use wget without cert issue, but during building an image I get cert failures.
How can make sure the build tools also use the added root certificate?
I'm using freetz-ubuntu-25.4, but I don't think this is specific to freetz-linux.

Not working:

--2026-07-19 14:37:00--  https://github.com/libffi/libffi/releases/download/v3.7.1/libffi-3.7.1.tar.gz
Resolving github.com... 140.82.121.3
Connecting to github.com|140.82.121.3|:443... connected.
ERROR: cannot verify github.com's certificate, issued by 'CN=Zscaler Intermediate Root CA (zscaler.net) (t)\\ ,OU=Zscaler Inc.,O=Zscaler Inc.,ST=California,C=US':
  Unable to locally verify the issuer's authority.
To connect to github.com insecurely, use `--no-check-certificate'.
Download failed - "https://github.com/libffi/libffi/releases/download/v3.7.1/libffi-3.7.1.tar.gz"  ->  error code 5

Working:
cd /home/freetz/.freetz-dl
wget https://github.com/libffi/libffi/releases/download/v3.7.1/libffi-3.7.1.tar.gz

freetz@freetz-ng:~/.freetz-dl$ wget https://github.com/libffi/libffi/releases/download/v3.7.1/libffi-3.7.1.tar.gz
--2026-07-19 17:35:01--  https://github.com/libffi/libffi/releases/download/v3.7.1/libffi-3.7.1.tar.gz
Resolving github.com (github.com)... 140.82.121.4
Connecting to github.com (github.com)|140.82.121.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://release-assets.githubusercontent.com/github-production-release-asset/321154/ba67c7b1-b3a0-43a0-95e6-5df5e8a8a4cf?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-07-19T18%3A27%3A12Z&rscd=attachment%3B+filen
--2026-07-19 17:35:01--  https://release-assets.githubusercontent.com/github-production-release-asset/321154/ba67c7b1-b3a0-43a0-95e6-5df5e8a8a4cf?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-07-19T18%3A27%3A12Z&rscd=atta
Resolving release-assets.githubusercontent.com (release-assets.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.108.133, ...
Connecting to release-assets.githubusercontent.com (release-assets.githubusercontent.com)|185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1515185 (1.4M) [application/octet-stream]
Saving to: ‘libffi-3.7.1.tar.gz’

libffi-3.7.1.tar.gz                                        100%[=====================================================================================================================================>]   1.44M  --.-KB/s

Steps used to add the Zscaler root cert:

Export from the certificate viewer (Chrome/Edge):
Visit https://github.com.
Click the padlock icon in the address bar.
Click Connection is secure.
Click Certificate is valid (or Certificate).
In the certificate viewer, look at the Certification Path tab.
Select the top-most certificate, which should be something like Zscaler Root CA or Zscaler Intermediate Root CA.
Click View Certificate → Details → Export.
Save it as Base-64 encoded X.509 (.CER).

sudo cp ZscalerRootCA.cer /usr/local/share/ca-certificates/ZscalerRootCA.crt
sudo update-ca-certificates
Verify with:
git ls-remote https://github.com/Freetz-NG/freetz-ng.git

[fda77]

During build a self build wget+root CAs are used: https://github.com/Freetz-NG/freetz-ng/blob/master/make/host-tools/ca-bundle-host/ca-bundle-host.mk
Is Zscaler an official rootca? Then its missing here: https://curl.se/docs/caextract.html
Lokally you could extend the tools/cacert.pem

[rhermsen]

Thanks that should give sufficient details to get the cert added.
The Zscaler is not a public root ca, and indeed not included.