[Bug]: Tool downloads fail when behind Zscaler

[aswaniamit]

What happened?

Description

Tool downloads from GitHub fail when running PPTB behind Zscaler (or any corporate SSL inspection proxy), even though GitHub is accessible in the browser.

Environment

• PPTB Version: 1.1.3
• OS: Windows 11
• Corporate proxy: Zscaler (SSL inspection / deep packet inspection enabled)
• Browser GitHub access: Working

Steps to Reproduce

1. Install PPTB on a machine behind a Zscaler proxy with SSL inspection enabled.
2. Open PPTB and navigate to the Tools section.
3. Attempt to browse or install any tool from GitHub.
4. Download fails silently or shows a network/connection error.

Expected Behavior

Tools should download successfully, as GitHub is reachable (browser confirms this).

Actual Behavior

Downloads fail. The underlying cause is an SSL certificate verification error. Zscaler
intercepts HTTPS traffic and re-signs it with its own root CA. This CA is installed in
the Windows system certificate store, which browsers trust. However, Node.js (used
internally by Electron for HTTP calls) maintains its own bundled CA store and does NOT
read from the Windows certificate store, so it rejects the Zscaler-signed certificate.

Expected error in logs: CERT_AUTHORITY_INVALID / unable to get local issuer certificate

Suggested Fix

One or more of the following would resolve this:

1. Use NODE_EXTRA_CA_CERTS – Document that users can set this environment variable
   to point to the Zscaler root CA .pem file before launching PPTB:
2. Use the OS certificate store in Node.js – Integrate a package such as
   win-ca or use Electron's net module
   (which uses Chromium's network stack and does honour the OS cert store) for all
   GitHub API/download calls instead of Node's https module.

This is a common issue for Electron apps in enterprise environments. Related prior art:

• VS Code handles this via win-ca / system certificate store integration
• Electron docs: https://www.electronjs.org/docs/latest/api/net (Chromium net vs Node https)

What version of the PPTB are you using?

1.1.3

Relevant log output