In today's episode of "how IT screwed up" their Zscaler security snakeoil is preventing machines from downloading actual security updates because dnf of course detects the certificate fsckery.

[slow clap]
#otsecurity