I am starting to work through the 3rd party CA process.
I have looked at Creating Endpoint with your own Certificate Authority - #11 by dovholuknf and watched the video, though I am not sure where to proceed.
Outcome (end goal): Use a Windows CA for auto client enrollment, as Windows can take care of (re)-enrolling client certificates using group policy.
So,
a. I created a new CA through the ZAC - this seemed to go well.
b. NOTE: When adding a CA through the GUI, can it jump into asking for the verification certificate as that is what it is expecting next, This will also show the user that this is what is logically next to be completed.
c. I have verified the certificate authority
Wheels now fell off.
I need to download a jwt token for the CA. Why can I not download this through the GUI? ie, when you have a list of the CA, have an option saying āDownload the JWTā file (along with Edit and Delete)? It is my understanding that this file is static for a 3rd party CA. This is where I am currently stuck.
What I have done:
Run the following command to find the id of CA (again not in the GUI anywhere)
ziti@5b8dcc17f2a1:/openziti$ ziti edge list cas
id: tYKkaXdfJ name: WindowsCA token: identityRoles: [#test] flags: [VAE] identityNameFormat: [caName]-[commonName] fingerprint: ad8e...6c
results: 1-1 of 1
Flags: (V) Verified, (A) AutoCa Enrollment, (O) OttCA Enrollment, (E) Authentication Enabled
This is how it looks:
I am running this through the docker-compose example, so from the docker-ziti-controller-1 container I do the following
ziti@5b8dcc17f2a1:/openziti$ edge_controller_uri="https://ziti-edge-controller:1280"
ziti@5b8dcc17f2a1:/openziti$ zt_session=$(curl -sk -H "Content-Type: application/json" \
${edge_controller_uri}/authenticate?method=password \
-d "{\"username\":\"admin\",\"password\":\"admin\"}" | \
jq -r .data.token)
ziti@5b8dcc17f2a1:/openziti$ echo $zt_session
7e236eea-2486-4495-af9b-1cef7827f817
ziti@5b8dcc17f2a1:/openziti$ curl -sk -H "Content-Type: application/json" \
-H "zt-session: ${zt_session}" \
"${edge_controller_uri}/cas"
{"error":{"cause":{"code":"UNHANDLED","message":"path /edge/client/v1/cas was not found"},"code":"NOT_FOUND","message":"The resource requested was not found or is no longer available","requestId":"EeNwUd6LKC"},"meta":{"apiEnrollmentVersion":"0.0.1","apiVersion":"0.0.1"}}
So I am having a difficulty getting the jwt.
Other questions
a) So I set this up with docker compose, which would have created itās own CA. All the edge components etc will be using this PKI. I have now added a third party CA (Well, kind of have). Will this impact connecting identities with one CA, and infrastructure with another? I would assume not, as they will all know about different all the CAs?
b) ZEDW - it appears that you I might need to export the machine/user certificate from the windows certificate store to be able to use it in ZEDW (ie, out of the OS native cert store, into the client cert store). Is it a possibility to have ZEDW when prompting for an ID, to list/detail the certs in the MACHINE/MY store and/or the USER/My store to use that information, along with a āHave fileā option. Ideally the client should be able to interface with the local certificate stores? This way, when WIndows updates the certs, the client should see/use this change.
c) By the looks, identities need to be configured with [caname]-[identityname]. Can this be changed? Not sure how this will work with Windows auto-enrollment certs which are just machine or username based.
Some of these items will hopefully be able to answer when I can (easily) get the jwt token.
sorry about that. I filed an issue to download the jwt for an 'auto enrollment enabled CA' from ZAC here 
there's no good way to "import an identity" through the UI like this right now. You can import it, but you need to be admin to the machine because ZDEW runs under the system account. You can copy that json file directly into