# Alt\_server\_certs not working properly

**URL:** <https://openziti.discourse.group/t/alt-server-certs-not-working-properly/4744>\
**Category:** Ziti Overlay\
**Created:** [June 14, 2025, 9:32pm UTC](https://openziti.discourse.group/t/alt-server-certs-not-working-properly/4744 "2025-06-14T21:32:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![brandi](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@brandi](https://openziti.discourse.group/u/brandi)\
**Post date:** [June 14, 2025, 9:32pm UTC](https://openziti.discourse.group/t/alt-server-certs-not-working-properly/4744/1 "2025-06-14T21:32:19Z")

</div>

Hey,

I'm deploying my controller using docker (image version 1.6.2).

Here's my config.yaml:

```auto
v: 3
db: "/ziti-controller/bbolt.db"

identity:
  cert: "pki/intermediate/certs/client.chain.pem"
  server_cert: "pki/intermediate/certs/server.chain.pem"
  key: "pki/intermediate/keys/server.key"
  ca: "pki/root/certs/root.cert"

ctrl:
  options:
    advertiseAddress: tls:overlay.abc.com:1280
  listener: tls:0.0.0.0:1280

healthChecks:
  boltCheck:
    interval: 30s
    timeout: 20s
    initialDelay: 30s

edge:
  api:
    sessionTimeout: 30m
    address: overlay.abc.com:1280
  enrollment:
    signingCert:
      cert: pki/intermediate/certs/intermediate.cert
      key: pki/intermediate/keys/intermediate.key
    edgeIdentity:
      duration: 180m
    edgeRouter:
      duration: 180m

web:
  - name: all-apis
    bindPoints:
      - interface: 0.0.0.0:1280
        address: overlay.abc.com:1280
    identity:
      ca: "pki/root/certs/root.cert"
      key: "pki/intermediate/keys/server.key"
      server_cert: "pki/intermediate/certs/server.chain.pem"
      cert: "pki/intermediate/certs/client.chain.pem"

      alt_server_certs:

        - server_cert: "/alt_server_certs/etc/letsencrypt/live/overlay.xyz.com/cert.pem"
          server_key: "/alt_server_certs/etc/letsencrypt/live/overlay.xyz.com/privkey.pem"

    options:
      idleTimeout: 5000ms
      readTimeout: 5000ms
      writeTimeout: 100000ms
      minTLSVersion: TLS1.2
      maxTLSVersion: TLS1.3
    apis:
      - binding: edge-management
        options: { }
      - binding: fabric
        options: { }
      - binding: edge-oidc
        options: { }
      - binding: edge-client
        options: { }
      - binding: zac
        options:
          location: /ziti-console
          indexFile: index.html

```

The certificates in `alt_server_certs` are generated for both domain "[overlay.abc.com](http://overlay.abc.com)" and "[overlay.xyz.com](http://overlay.xyz.com)":

```auto
ares@docker_server_1:/etc/letsencrypt/live/overlay.xyz.com$ openssl x509 -in cert.pem -noout -text | grep -A1 "Subject Alternative Name"
            X509v3 Subject Alternative Name:
                DNS:overlay.abc.com, DNS:overlay.xyz.com

```

When I got to `https://overlay.abc.com:1280/zac` it looks like it's presenting the self signed certificate generated by Openziti. But when going into `https://overlay.xyz.com:1280/zac` everything seems to be working fine (it's presenting the actual cert I provided into alt\_server\_certs ).

Any idea of what could be the issue ?

---

<div class="post-metadata">

**Author:** ![frm](https://avatars.discourse-cdn.com/v4/letter/f/b9bd4f/32.png) [@frm](https://openziti.discourse.group/u/frm)\
**Post date:** [June 16, 2025, 7:38am UTC](https://openziti.discourse.group/t/alt-server-certs-not-working-properly/4744/2 "2025-06-16T07:38:23Z")

</div>

You should not mix the domains. Use one domain for OpenZiti and another for the alternative server cert.