# A question about third-party CA

**URL:** <https://openziti.discourse.group/t/a-question-about-third-party-ca/5862>\
**Category:** tunneler-sdk-c\
**Created:** [May 31, 2026, 3:08pm UTC](https://openziti.discourse.group/t/a-question-about-third-party-ca/5862 "2026-05-31T15:08:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pklong020](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@pklong020](https://openziti.discourse.group/u/pklong020)\
**Post date:** [May 31, 2026, 3:08pm UTC](https://openziti.discourse.group/t/a-question-about-third-party-ca/5862/1 "2026-05-31T15:08:11Z")

</div>

Hello there，I am currently trying to build a zero trust network that covers same IoT devices using openziti. At first, everything went smoothly, but when I tried to use the tunneler on IoT devices, I have encountered a problem. I have created a third-party CA already, so how can I use the certificate and private key issued by this CA on IoT devices to automatically create a ziti identity when accessing?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [June 4, 2026, 12:00pm UTC](https://openziti.discourse.group/t/a-question-about-third-party-ca/5862/2 "2026-06-04T12:00:52Z")

</div>

Hi @pklong020, welcome to the community and to OpenZiti!

Did you toggle the "Auto Enroll" option in ZAC? (or with the `--autoca` flag if using the ziti cli)

![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/e/eea43f693fb0f986a2d947ea3da0a8119d9d2da6.png)

That should be all that's required. Is auto enroll enabled?