# Ziti Overlay **URL:** https://openziti.discourse.group/c/ziti-overlay/8.md?page=1 [Latest](https://openziti.discourse.group/latest.md) · [Categories](https://openziti.discourse.group/categories.md) **Page:** 2 --- ## [Router OIDC Support](https://openziti.discourse.group/t/router-oidc-support/5654)
**Author:** [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\ **Replies:** 5\ **Last updated:** [February 27, 2026, 12:51pm UTC](https://openziti.discourse.group/t/router-oidc-support/5654 "2026-02-27T12:51:04Z")
I'd like to ask if the router currently supports Keycloak authentication.If it's supported, how do I do it？ --- ## [Android SDK and bindUsingEdgeIdentity](https://openziti.discourse.group/t/android-sdk-and-bindusingedgeidentity/5575)
**Author:** [@Mathis](https://openziti.discourse.group/u/Mathis)\ **Replies:** 0\ **Last updated:** [February 19, 2026, 10:22am UTC](https://openziti.discourse.group/t/android-sdk-and-bindusingedgeidentity/5575 "2026-02-19T10:22:58Z")
Hello I am trying to make a basic app using the Android SDK and flutter, I managed to have the SDK running, enrollment works fine, but then I can't manage to connect to a service. Knowing our network uses "bindUsingEdg… --- ## [Controller v1.6.8 disconnects tunnelers](https://openziti.discourse.group/t/controller-v1-6-8-disconnects-tunnelers/5195)
**Author:** [@dmuensterer](https://openziti.discourse.group/u/dmuensterer)\ **Replies:** 42\ **Last updated:** [February 19, 2026, 8:31am UTC](https://openziti.discourse.group/t/controller-v1-6-8-disconnects-tunnelers/5195 "2026-02-19T08:31:53Z")
Hi, we’ve upgrade our controllers, routers and all ziti-edge-tunnels to the newest version yesterday. controller: v1.6.8 router: v1.6.8 ziti-edge-tunnel: v1.7.12 This morning we got random alerts that many of our zi… --- ## [Node.js ziti.init returns code -13](https://openziti.discourse.group/t/node-js-ziti-init-returns-code-13/5538)
**Author:** [@Eric](https://openziti.discourse.group/u/Eric)\ **Replies:** 36\ **Last updated:** [February 14, 2026, 5:45am UTC](https://openziti.discourse.group/t/node-js-ziti-init-returns-code-13/5538 "2026-02-14T05:45:55Z")
Hello Team, Currently trying to set sdk using NodeJS version 20.20.0. Identity has been created and well enrolled but when I run below code, result is "auth ziti.init() failed with return code -13". import ziti from '@… --- ## [URGENT!... Unable to access RDP service](https://openziti.discourse.group/t/urgent-unable-to-access-rdp-service/5470)
**Author:** [@ageorge](https://openziti.discourse.group/u/ageorge)\ **Replies:** 41\ **Last updated:** [February 12, 2026, 4:21pm UTC](https://openziti.discourse.group/t/urgent-unable-to-access-rdp-service/5470 "2026-02-12T16:21:11Z")
I have Openziti configured in a single Debian VM. I am using zac console to configure the identities, services and policies. I have a Windows server as identity configured to host (bound) rdp service configured with po… --- ## [Community Feedback Requested: CLI Refactor](https://openziti.discourse.group/t/community-feedback-requested-cli-refactor/5560)
**Author:** [@plorenz](https://openziti.discourse.group/u/plorenz)\ **Replies:** 0\ **Last updated:** [February 11, 2026, 9:33pm UTC](https://openziti.discourse.group/t/community-feedback-requested-cli-refactor/5560 "2026-02-11T21:33:59Z")
Hi everyone, We've been discussing doing some cleanup of the OpenZiti CLI. Here is a write-up describing the changes: ziti/doc/cli-2.0.md at ea3aced311ccfff30f7c25554a88190afafd27d1 · openziti/ziti · GitHub TL;DR - H… --- ## [Plans to use a similiar NAT Traversal functionality like Tailscale](https://openziti.discourse.group/t/plans-to-use-a-similiar-nat-traversal-functionality-like-tailscale/5529)
**Author:** [@michi](https://openziti.discourse.group/u/michi)\ **Replies:** 7\ **Last updated:** [February 2, 2026, 9:42pm UTC](https://openziti.discourse.group/t/plans-to-use-a-similiar-nat-traversal-functionality-like-tailscale/5529 "2026-02-02T21:42:54Z")
Hi there! I have been using OpenZiti in my home lab for about two months now, and since I started implementing it, I have been wondering why all traffic between my tunnelers always has to run through a router and why th… --- ## [OpenZiti overlay for simple homelab](https://openziti.discourse.group/t/openziti-overlay-for-simple-homelab/5541)
**Author:** [@barta50](https://openziti.discourse.group/u/barta50)\ **Replies:** 3\ **Last updated:** [February 2, 2026, 5:53pm UTC](https://openziti.discourse.group/t/openziti-overlay-for-simple-homelab/5541 "2026-02-02T17:53:20Z")
Hello I want to test out OpenZiti for my simple homelab which I am using for my bachelors thesis. The thesis goals are to test out various free solutions for implementing zero trust architecture at home. These solutions … --- ## [Certificate validation error: "identity is not valid for provided host" despite host being listed as valid](https://openziti.discourse.group/t/certificate-validation-error-identity-is-not-valid-for-provided-host-despite-host-being-listed-as-valid/5104)
**Author:** [@cstrong84](https://openziti.discourse.group/u/cstrong84)\ **Replies:** 10\ **Last updated:** [January 20, 2026, 2:02pm UTC](https://openziti.discourse.group/t/certificate-validation-error-identity-is-not-valid-for-provided-host-despite-host-being-listed-as-valid/5104 "2026-01-20T14:02:38Z")
I'm encountering a persistent certificate validation error when setting up OpenZiti controller on TrueNAS. The error message appears contradictory and I've tried multiple approaches without success. Error Message: prov… --- ## [How to shutdown a ziti link?](https://openziti.discourse.group/t/how-to-shutdown-a-ziti-link/5490)
**Author:** [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Replies:** 4\ **Last updated:** [January 17, 2026, 5:59pm UTC](https://openziti.discourse.group/t/how-to-shutdown-a-ziti-link/5490 "2026-01-17T17:59:54Z")
I would like to put some unreliable links into down state if possible. Some ISPs drop packets depending on who initiates the connection — for example, A→B fails, but B→A works. ziti fabric list links 'limit none' -j |… --- ## [Errors under load on an http service](https://openziti.discourse.group/t/errors-under-load-on-an-http-service/5472)
**Author:** [@ffaraone](https://openziti.discourse.group/u/ffaraone)\ **Replies:** 2\ **Last updated:** [January 9, 2026, 6:17pm UTC](https://openziti.discourse.group/t/errors-under-load-on-an-http-service/5472 "2026-01-09T18:17:46Z")
Hello there, and happy New Year, guys! We have a 1-controller 1-router ziti network that we use to expose remote HTTP services in a way very similar to how zrok exposes them (we implemented our own “zrok” frontend, loca… --- ## [Authentication Error (UNAUTHORIZED) when enrolling Identity (QuickStart Docker Compose)](https://openziti.discourse.group/t/authentication-error-unauthorized-when-enrolling-identity-quickstart-docker-compose/5459)
**Author:** [@TanakaShunya](https://openziti.discourse.group/u/TanakaShunya)\ **Replies:** 1\ **Last updated:** [December 29, 2025, 1:57pm UTC](https://openziti.discourse.group/t/authentication-error-unauthorized-when-enrolling-identity-quickstart-docker-compose/5459 "2025-12-29T13:57:46Z")
Hello, First of all, thank you for such an amazing product. I'm currently setting up a test environment following the QuickStart guide to get familiar with OpenZiti. Goal: I am using Docker Compose on a server with a p… --- ## [OpenZiti PKI distribution](https://openziti.discourse.group/t/openziti-pki-distribution/5455)
**Author:** [@rookiejtc](https://openziti.discourse.group/u/rookiejtc)\ **Replies:** 4\ **Last updated:** [December 27, 2025, 7:29pm UTC](https://openziti.discourse.group/t/openziti-pki-distribution/5455 "2025-12-27T19:29:29Z")
Is there a guide somewhere on how best to integrate our own PKI into OpenZiti and reliably distribute the new certificates to all devices (including all existing clients)? For xample also when renewing all certs after a… --- ## [OIDC external JWT auth](https://openziti.discourse.group/t/oidc-external-jwt-auth/5438)
**Author:** [@Guardiant314](https://openziti.discourse.group/u/Guardiant314)\ **Replies:** 9\ **Last updated:** [December 27, 2025, 1:09pm UTC](https://openziti.discourse.group/t/oidc-external-jwt-auth/5438 "2025-12-27T13:09:13Z")
Hello, I am configuring OIDC external JWT authentication (Keycloak) with OpenZiti. Deployment: Controller: Docker ZAC: Docker Keycloak: Docker Tunneller: running locally (not in Docker) My goal is: Run … --- ## [Ziti router run with TPROXY mode](https://openziti.discourse.group/t/ziti-router-run-with-tproxy-mode/5390)
**Author:** [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Replies:** 3\ **Last updated:** [December 23, 2025, 8:34pm UTC](https://openziti.discourse.group/t/ziti-router-run-with-tproxy-mode/5390 "2025-12-23T20:34:08Z")
I would like to add a Ziti Gateway as described in "Use a Router as a Local Gateway". Currently, my router is configured as follows and works as a reverse proxy: listeners: # bindings of edge and tunnel requires an "ed… --- ## [Authentication with external CA and ext-jwt-signer](https://openziti.discourse.group/t/authentication-with-external-ca-and-ext-jwt-signer/5412)
**Author:** [@dledanseur](https://openziti.discourse.group/u/dledanseur)\ **Replies:** 3\ **Last updated:** [December 19, 2025, 9:47am UTC](https://openziti.discourse.group/t/authentication-with-external-ca-and-ext-jwt-signer/5412 "2025-12-19T09:47:26Z")
Hi there, I'm trying to wrap my head around how to implement the following requirements. I would like: to ensure that only devices I control can enroll in Ziti (using a non-exportable certificate, for instance), t… --- ## [Reliable way to use open ziti clients](https://openziti.discourse.group/t/reliable-way-to-use-open-ziti-clients/5426)
**Author:** [@NullZiti](https://openziti.discourse.group/u/NullZiti)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 6:37pm UTC](https://openziti.discourse.group/t/reliable-way-to-use-open-ziti-clients/5426 "2025-12-15T18:37:03Z")
Hi everyone, We started deploying OpenZiti agents for both macOS and Linux users a week ago, after deploying OpenZiti across most of our infrastructure. Unfortunately, there have been many inconsistencies and issues wi… --- ## [Cryptographic error when adding controller to cluster](https://openziti.discourse.group/t/cryptographic-error-when-adding-controller-to-cluster/5357)
**Author:** [@Damien](https://openziti.discourse.group/u/Damien)\ **Replies:** 5\ **Last updated:** [December 15, 2025, 8:33am UTC](https://openziti.discourse.group/t/cryptographic-error-when-adding-controller-to-cluster/5357 "2025-12-15T08:33:06Z")
Hello! I have an issue when adding a controller to a cluster from another controller. Here is what I did: My entire infrastructure is running inside a Docker Compose setup, which allows me to test different types of in… --- ## [Problem with importing network.jwt or using the URL method](https://openziti.discourse.group/t/problem-with-importing-network-jwt-or-using-the-url-method/5420)
**Author:** [@Jameshclai](https://openziti.discourse.group/u/Jameshclai)\ **Replies:** 5\ **Last updated:** [December 15, 2025, 5:04am UTC](https://openziti.discourse.group/t/problem-with-importing-network-jwt-or-using-the-url-method/5420 "2025-12-15T05:04:38Z")
I'm trying to use ODIC for third-party authentication, but the network information in Windows Edge is empty when importing network.jwt or using the URL method. Here's my installation process: Using the Express Instal… --- ## [Onprem AD/gpupdate](https://openziti.discourse.group/t/onprem-ad-gpupdate/5422)
**Author:** [@strongwazz](https://openziti.discourse.group/u/strongwazz)\ **Replies:** 4\ **Last updated:** [December 15, 2025, 4:12am UTC](https://openziti.discourse.group/t/onprem-ad-gpupdate/5422 "2025-12-15T04:12:41Z")
We have a ziti environment, on 1.7.1 I have a basic service setup, that mimics emoscardini’s approach ( Conneting Remote Endpoints with a On-Prem AD - #6 by emoscardini ) For argument’s sake, we have hosted tenant env… --- ## [How to forward https?](https://openziti.discourse.group/t/how-to-forward-https/5403)
**Author:** [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Replies:** 13\ **Last updated:** [December 5, 2025, 9:06pm UTC](https://openziti.discourse.group/t/how-to-forward-https/5403 "2025-12-05T21:06:51Z")
I am trying to configure my Ziti router to forward HTTPS traffic from a port (for example, 825) to an external domain (destination.domain.zone). Essentially, I would like the router to terminate the TCP connection. I wou… --- ## [Router enrollment fails with "token signature is invalid" - JWT kid vs EST cacerts mismatch](https://openziti.discourse.group/t/router-enrollment-fails-with-token-signature-is-invalid-jwt-kid-vs-est-cacerts-mismatch/5394)
**Author:** [@jfin](https://openziti.discourse.group/u/jfin)\ **Replies:** 5\ **Last updated:** [December 3, 2025, 8:09pm UTC](https://openziti.discourse.group/t/router-enrollment-fails-with-token-signature-is-invalid-jwt-kid-vs-est-cacerts-mismatch/5394 "2025-12-03T20:09:58Z")
Ziti Version: v1.1.3 (ARM64, Amazon Linux 2023) Deployment: Custom PKI on bare EC2 (not K8s, not quickstart) Problem Router enrollment fails with: token signature is invalid: crypto/rsa: verification error Root Cause… --- ## [App-identity based enrollment](https://openziti.discourse.group/t/app-identity-based-enrollment/5374)
**Author:** [@Faezz001](https://openziti.discourse.group/u/Faezz001)\ **Replies:** 3\ **Last updated:** [December 2, 2025, 1:50pm UTC](https://openziti.discourse.group/t/app-identity-based-enrollment/5374 "2025-12-02T13:50:36Z")
Can OpenZiti enroll an integrated Ziti application as an identity instead of a user or device? For example, if the application is distributed to multiple users, the posture policy would remain the same for all of them. I… --- ## [Router's cost per zid](https://openziti.discourse.group/t/routers-cost-per-zid/5342)
**Author:** [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Replies:** 0\ **Last updated:** [November 17, 2025, 9:21pm UTC](https://openziti.discourse.group/t/routers-cost-per-zid/5342 "2025-11-17T21:21:16Z")
I have recently connected a new user via Zrok. Unfortunately, his local network is unstable, showing a wide variation of ping times to his home router: 2 ms, 14 ms, 8 ms, 4 ms. Additionally, there is a very fast Ziti ro… --- ## [Ziti routers and ECH](https://openziti.discourse.group/t/ziti-routers-and-ech/5320)
**Author:** [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Replies:** 4\ **Last updated:** [November 17, 2025, 4:17pm UTC](https://openziti.discourse.group/t/ziti-routers-and-ech/5320 "2025-11-17T16:17:31Z")
Is there a way to enable ECH for ziti network? --- ## [Wildcard intercept stops working when a host-specific RDP service is also assigned](https://openziti.discourse.group/t/wildcard-intercept-stops-working-when-a-host-specific-rdp-service-is-also-assigned/5312)
**Author:** [@msbusk](https://openziti.discourse.group/u/msbusk)\ **Replies:** 3\ **Last updated:** [November 7, 2025, 2:48pm UTC](https://openziti.discourse.group/t/wildcard-intercept-stops-working-when-a-host-specific-rdp-service-is-also-assigned/5312 "2025-11-07T14:48:59Z")
Hi all, I’m running into an odd behavior with two ZTNA services assigned to the same Edge client: Service A (wildcard): intercepts \*.subdomian.example.tld and .subdomian.example.tld for a range of TCP/UDP ports (Kerb… --- ## [Dialing from a containerised service](https://openziti.discourse.group/t/dialing-from-a-containerised-service/5247)
**Author:** [@nibble](https://openziti.discourse.group/u/nibble)\ **Replies:** 8\ **Last updated:** [October 24, 2025, 6:26pm UTC](https://openziti.discourse.group/t/dialing-from-a-containerised-service/5247 "2025-10-24T18:26:21Z")
Currently exploring the use of OpenZiti. I have a containerised router set up to facilitate user access to some services running in their own containers (all docker compose). So far, so good. Now I need containerised ser… --- ## [Router stability issues](https://openziti.discourse.group/t/router-stability-issues/5233)
**Author:** [@kragifel](https://openziti.discourse.group/u/kragifel)\ **Replies:** 9\ **Last updated:** [October 22, 2025, 6:52pm UTC](https://openziti.discourse.group/t/router-stability-issues/5233 "2025-10-22T18:52:20Z")
I’ve built out a small environment consisting of a router/controller (1.6.8) co-located on a publicly available aws instance and a second private router (1.6.8) within an on-prem environment with a series of edge tunnele… --- ## [Expired token message](https://openziti.discourse.group/t/expired-token-message/5142)
**Author:** [@Tikal](https://openziti.discourse.group/u/Tikal)\ **Replies:** 3\ **Last updated:** [September 28, 2025, 8:02am UTC](https://openziti.discourse.group/t/expired-token-message/5142 "2025-09-28T08:02:54Z")
Hi, We have an issue where we get an error of Expired token on one of our routers, the message shown in the router logs is :slight\_smile: {"file":"\`\`github.com/openziti/ziti/router/xgress\_edge/hosted.go:472","func":"git… --- ## [Unable to forward payload](https://openziti.discourse.group/t/unable-to-forward-payload/5109)
**Author:** [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Replies:** 34\ **Last updated:** [September 26, 2025, 7:24am UTC](https://openziti.discourse.group/t/unable-to-forward-payload/5109 "2025-09-26T07:24:32Z")
With ziti-router 1.6.7 I have too much errors. Thus the network is slow. { "\_context": "{c/4CpuIMbl75baXLw6iK4v3J|@/7ADl07XYWjSjImnvZaTi05}\", "circuitId": "4CpuIMbl75baXLw6iK4v3J", "error": "cannot forw… [Previous page](https://openziti.discourse.group/c/ziti-overlay/8.md) [Next page](https://openziti.discourse.group/c/ziti-overlay/8.md?page=2)