# BrowZer failed to start
**URL:** https://openziti.discourse.group/t/browzer-failed-to-start/3272
**Category:** Uncategorized
**Created:** [October 18, 2024, 8:38am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272 "2024-10-18T08:38:21Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 18, 2024, 8:38am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/1 "2024-10-18T08:38:21Z")
I followed the documentation: [BrowZer | OpenZiti](https://openziti.io/docs/learn/quickstarts/browzer/#cloning-from-github) to clone the project. After that, I created a `.env` file in the project root directory with the following content.
```auto
ZITI_BROWZER_BOOTSTRAPPER_HOST="browzer.zititv.demo.openziti.org"
ZITI_BROWZER_BOOTSTRAPPER_LOGLEVEL="debug"
ZITI_BROWZER_RUNTIME_LOGLEVEL="debug"
ZITI_BROWZER_RUNTIME_HOTKEY="alt+F12"
ZITI_CONTROLLER_HOST="ziti.edge.controller"
ZITI_CONTROLLER_PORT="1280"
ZITI_BROWZER_BOOTSTRAPPER_SCHEME="https"
ZITI_BROWZER_BOOTSTRAPPER_LISTEN_PORT="8446"
ZITI_BROWZER_BOOTSTRAPPER_TARGETS='{"targetArray":[{"vhost":"docker-whale.zititv.demo.openziti.org","service":"docker.whale","path":"/","scheme":"http","idp_issuer_base_url":"https://dev-b2q0t23rxctngxka.us.auth0.com","idp_client_id":"Yo1JXbaLhp045p8tvLJTbRbGw6TU2xjj"}]}'
```
The following error is displayed:
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 18, 2024, 8:41am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/2 "2024-10-18T08:41:36Z")
There is no description of this variable below，How should I define this variable
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 18, 2024, 8:49am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/3 "2024-10-18T08:49:27Z")
I started OpenZiti locally using the docker-compose method, and now I want to start Browzer. According to the documentation at [BrowZer | OpenZiti](https://openziti.io/docs/learn/quickstarts/browzer/), I need to complete the OIDC section. The prerequisites mention that a functional OpenZiti overlay network and a configured alternative server certificate are required. I’m not sure if the 'local docker-compose' setup meets these requirements. Additionally, there's an environment variable for running the Ziti BrowZer Bootstrapper, with the following description:
`ZITI_CONTROLLER_HOST`: the 'alternative' address for the OpenZiti controller. Example: `ctrl.openziti.io`
How should 'alternative' be understood here? There is a `ziti-edge-controller` in the 'local docker-compose' setup. Should I use its host for this?
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 18, 2024, 8:55am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/4 "2024-10-18T08:55:10Z")
I have another question. I noticed that the startup command includes a `NODE_EXTRA_CA_CERTS` parameter. Does this mean that the `ZITI_BROWZER_BOOTSTRAPPER_CERTIFICATE_PATH` and `ZITI_BROWZER_BOOTSTRAPPER_KEY_PATH` variables do not need to be defined in the environment variables? If they are still required, how should these two variables be created for an OpenZiti setup built locally using docker-compose?
---
### Author:  [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)
#### Post date: [October 18, 2024, 11:25am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/5 "2024-10-18T11:25:37Z")
> [@yolk23321](#):
>
> I started OpenZiti locally using the docker-compose method, and now I want to start Browzer.
BrowZer really needs to have legitimate, 3rd party verifiable certificates from a publicly trusted CA, something like LetsEncrypt or ZeroSSL (or other). So beware of that particular problem. If you're running it locally from the example docker-compose quickstart, you'll likely struggle with BrowZer. you can do it, but it gets more complex due to the self-signed CA/pki... Just beware. It's way easier to start with BrowZer with a public url, and alt server certs setup. I assume you also discovered the sub menu item of the example setup here [Example Enabling BrowZer | OpenZiti](https://openziti.io/docs/learn/quickstarts/browzer/example/) ? It's got a video that goes along and has a full video walkthrough too. Maybe that will be a good resource for you to review but it doesn't use the docker compose quickstart so - maybe not. Maybe this would be a good topic for Ziti TV, I don't have one queued up but a "working session" of me trying to get browzer working might be educational? Ziti TV airs at 11 AM ET on Fridays when I have a topic to cover (approx 3.5 hours from right now) You can find them here [https://www.youtube.com/playlist?list=PLMUj\_5fklasKBlnVqh6YJuURKlgo39Yo1](https://www.youtube.com/playlist?list=PLMUj_5fklasKBlnVqh6YJuURKlgo39Yo1)
`ZITI_CONTROLLER_HOST` is the externally visible url to the controller that has that 3rd party, trusted certificate. So for me, you can see my value is `ZITI_CONTROLLER_HOST: ctrl.clint.demo.openziti.org` (and with the port [https://ctrl.clint.demo.openziti.org:8441/](https://ctrl.clint.demo.openziti.org:8441/)) you can get to this url and inspect the certificate if you like. So this is the "alternate" url because there's ALSO the self-signed PKI on the internet at this address (the 'main' url) [https://ec2-3-142-245-63.us-east-2.compute.amazonaws.com:8441/](https://ec2-3-142-245-63.us-east-2.compute.amazonaws.com:8441/)
Here's a sample environment from my running BrowZer install:
```auto
environment:
NODE_ENV: production
ZITI_BROWZER_BOOTSTRAPPER_LOGLEVEL: debug
ZITI_BROWZER_RUNTIME_LOGLEVEL: debug
ZITI_CONTROLLER_HOST: ctrl.clint.demo.openziti.org
ZITI_CONTROLLER_PORT: 8441
ZITI_BROWZER_BOOTSTRAPPER_HOST: browzer.clint.demo.openziti.org
ZITI_BROWZER_BOOTSTRAPPER_LISTEN_PORT: 443
ZITI_BROWZER_BOOTSTRAPPER_CERTIFICATE_PATH: /etc/letsencrypt/live/clint.demo.openziti.org/fullchain.pem
ZITI_BROWZER_BOOTSTRAPPER_KEY_PATH: /etc/letsencrypt/live/clint.demo.openziti.org/privkey.pem
ZITI_BROWZER_BOOTSTRAPPER_SCHEME: https
ZITI_BROWZER_RUNTIME_ORIGIN_TRIAL_TOKEN: "YOUR_TOKEN_HERE"
_ZITI_BROWZER_BOOTSTRAPPER_WILDCARD_VHOSTS: false
ZITI_BROWZER_BOOTSTRAPPER_TARGETS: >
{
"targetArray": [
{
"vhost": "docker-whale.clint.demo.openziti.org",
"service": "docker.whale",
"path": "/",
"scheme": "http",
"idp_issuer_base_url": "https://keycloak.clint.demo.openziti.org:8446/realms/zitirealm",
"idp_client_id": "browzerBootstrapClient",
"idp_type": "keycloak",
"idp_realm": "zitirealm"
},
{
"vhost": "brozac.clint.demo.openziti.org",
"service": "brozac",
"path": "/",
"scheme": "http",
"idp_issuer_base_url": "https://keycloak.clint.demo.openziti.org:8446/realms/zitirealm",
"idp_client_id": "browzerBootstrapClient",
"idp_type": "keycloak",
"idp_realm": "zitirealm"
},
{
"vhost": "puter.clint.demo.openziti.org",
"service": "puter",
"path": "/",
"scheme": "http",
"idp_issuer_base_url": "https://keycloak.clint.demo.openziti.org:8446/realms/zitirealm",
"idp_client_id": "browzerBootstrapClient",
"idp_type": "keycloak",
"idp_realm": "zitirealm"
}
]
}
```
`NODE_EXTRA_CA_CERTS` -- as I recall (I'm fuzzy on it right now as I don't use this feature much) is to allow you to use your own PKI for the BrowZer bootstrapper so that it can actually connect to a controller without an third-party server cert (self-signed PKI). This is part of the "more complex" part I was alluduing to before.
We don't have a "how to browzer entirely locally" guide that I know of. That also might be a good Ziti TV topic in general. it's a similar idea.
hope that helps?
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 21, 2024, 3:54am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/7 "2024-10-21T03:54:20Z")
@TheLumberjack Is it possible to fully deploy the Network and BrowZer on a server with a domain name and certificate, without using Docker Compose?
---
### Author:  [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)
#### Post date: [October 21, 2024, 3:57am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/8 "2024-10-21T03:57:23Z")
BrowZer itself will want a compose file (or at least docker0. We don't support deploying it via any other mechanisms. The OpenZiti overlay you can deploy without docker.
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 21, 2024, 6:12am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/9 "2024-10-21T06:12:18Z")
@TheLumberjack Can’t BrowZer be cloned directly from GitHub? Why is Docker still required?
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 21, 2024, 6:15am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/10 "2024-10-21T06:15:52Z")
I have an Ubuntu server ready, and I’ll be following the steps in this video to install OpenZiti and BrowZer: [https://www.youtube.com/watch?v=ZPkOQbVEnW0&t=817s](https://www.youtube.com/watch?v=ZPkOQbVEnW0&t=817s)
---
### Author:  [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)
#### Post date: [October 21, 2024, 11:53am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/11 "2024-10-21T11:53:58Z")
Surely it can, but I personally haven't done it and I don't know if there are any additional nuances necessary to clone the repo, build it, put pieces in the proper places etc. That's why I was indicating that docker was the preferred execution path for browzer at this time. If there are "no docker" instructions, I'll see if @curt can comment.
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 22, 2024, 2:49am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/12 "2024-10-22T02:49:16Z")
@TheLumberjack BrowZer is constantly restarting.
Then I ran this command: journalctl -fu browzer-bootstrapper, and the output was as follows:
---
### Author:  [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)
#### Post date: [October 22, 2024, 3:59am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/13 "2024-10-22T03:59:19Z")
Looks like you're having a name resolution problem based on the log
I don't know if this was working and now isn't, or where you're at but my guess is you misconfigured that or didn't add the wildcard record properly. (probably the latter?)
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 22, 2024, 4:08am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/14 "2024-10-22T04:08:58Z")
@TheLumberjack Yes, I just added a wildcard record in the DNS service provider’s console for the domain. Now, the BrowZer logs are as follows:
The content of my browzer.env file is as follows:
---
### Author:  [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)
#### Post date: [October 22, 2024, 4:14am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/15 "2024-10-22T04:14:31Z")
It states you have a self signed cert in the chain. You need to use 3rd party verifiable certs
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 22, 2024, 4:15am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/16 "2024-10-22T04:15:06Z")
Do you think these two images would be useful for troubleshooting the issue?
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 22, 2024, 4:18am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/17 "2024-10-22T04:18:48Z")
@TheLumberjack I modified ZITI\_CONTROLLER\_HOST in the browzer.env file to [openziti.devops.authing-inc.co](http://openziti.devops.authing-inc.co) and then restarted BrowZer. It started running normally, but when I accessed [https://brozac.openziti.devops.authing-inc.co:8446/](https://brozac.openziti.devops.authing-inc.co:8446/), a new error appeared. Would you like me to share a screenshot for further troubleshooting?
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 22, 2024, 8:25am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/18 "2024-10-22T08:25:44Z")
@TheLumberjack I’ve reconfigured everything, and the only remaining issue now is with creating the service. Please disregard the previous content and help me take a look at the current issue.
I started an HTTP service on the server using Python, and when I access [http://openziti.devops.authing-inc.co:8080](http://openziti.devops.authing-inc.co:8080) in a browser, it displays “helloworld.” Then, I created a service using the following method. From my understanding, intercept\_address and intercept\_port are used to configure the address of the service that needs to be intercepted, while offload\_address and offload\_port specify where OpenZiti forwards the request, which is the actual service address. After successfully creating the service, when I visit [https://brozac.openziti.devops.authing-inc.co:8446/](https://brozac.openziti.devops.authing-inc.co:8446/) in the browser, the following error appears.
If you need to review the configuration details on ZAC, I can share screenshots with you.
---
### Author:  [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)
#### Post date: [October 22, 2024, 11:03am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/19 "2024-10-22T11:03:37Z")
I'm surprised we have forgotten to add this to our doc. You're hitting the JSPI issue. If you search the forum for JSPI, you'll find many such posts including this one from @curt as to how to fix the issue:
> [@Browzer Setup - Error 1014 - OriginTrial subdomain mismatch](https://openziti.discourse.group/t/browzer-setup-error-1014-origintrial-subdomain-mismatch/2481/11):
>
> I'll do a more thorough write-up/blog soon, and even though this post might get a little long, the TL;DR is that BrowZer leverages [JSPI](https://v8.dev/blog/jspi). Until JSPI is finalized (and it is always present/enabled in the browser), it needs to be externally enabled in the browser somehow. JSPI can be enabled in multiple ways, including: by the end-user of the browser, by enabling the flag (down in chrome://flags), or... via what is known as an "[Origin Trial](https://developer.chrome.com/docs/web-platform/origin-trials)" Since some browsers (like Edge) have recently stoppe…
Follow those instructions and you'll get past the JSPI issue.
---
### Author:  [@yolk23321](https://openziti.discourse.group/u/yolk23321)
#### Post date: [October 22, 2024, 11:10am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/20 "2024-10-22T11:10:53Z")
@TheLumberjack Is the “Origin” specified here correct, or should it be set to “[brozac.openziti.devops.authing-inc.co](http://brozac.openziti.devops.authing-inc.co)”?
---
### Author:  [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)
#### Post date: [October 22, 2024, 11:16am UTC](https://openziti.discourse.group/t/browzer-failed-to-start/3272/21 "2024-10-22T11:16:02Z")
Yes. It should be your `${WILDCARD_URL}`
[Next page](https://openziti.discourse.group/t/browzer-failed-to-start/3272.md?page=2)