Hello, Watching this video: https://www.youtube.com/watch?v=ti1w7dQ3gSY&ab_channel=OpenZiti Would it work to combine the the docker compose simplified quickstart with browzer and keycloack using self-signed certs only? Thanks!

Hi @CarlosHleb , welcome to the community and to OpenZiti and Browzer! You could get it working with self-signed certs only, sure, but it's going to force you to add the self-signed CA into any and all clients that use Browzer... The reason the WSS-enabled edge router needs an independently verifia…

Hello, I am having issues with adding the self signed controllers certificats to browzer. Here's my docker-compose: services: ziti-controller: image: "${ZITI_IMAGE}:${ZITI_VERSION}" healthcheck: test: curl -m 1 -s -k -f https://${ZITI_CTRL_EDGE_ADVERTISED_ADDRESS:-ziti-edge-contro…

I think we'll want to have @curt confirm this, but that looks to me like the the browzer bootstrapper will need to have the self-signed CA as part of it's trust store. It might be necessary to add it to the os trust but I would start by making a CA bundle of trusted certs and setting this in your co…

Doesn't my docker compose already have that? NODE_EXTRA_CA_CERTS: /persistent/pki/ziti-edge-controller-intermediate/certs/ziti-edge-controller-server.chain.pem Maybe i am confusing stuff. I also tested by making bundle.pem and adding contents of ziti-edge-controller-server.chain.pem and exa…

This is how i made my example.com.cert: openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes -keyout example.com.key -out example.com.crt -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:*.example.com,IP:0.0.0.0"

I completely missed that your compose had it! Sorry about that... that chain is unlikely to contain the root CA, it should have everything BUT the root CA in it, I believe. Let me poke at it for a bit and see if I can find the issue.

Just to give you an update, I tried to get a workable docker compose file working today and got closer but ended up hitting a myriad of different issues. With version 0.59.0 we introduced a bug into using NODE_EXTRA_CA_CERTS. If you use 0.58.0 you can get it to work, but you need to override the en…

As a workaround i used NODE_TLS_REJECT_UNAUTHORIZED: 0, but ... I got another failed to verify certificate: x509: certificate signed by unknown authority, this time from the controller. Here's my full setup and logs thus far: docker-compose.yaml: name: ${PROJ_NAME} services: ziti-controller: …

Hi @CarlosHleb . Discourse marked your posts as spam, sorry about that... I've added the one that had the most information back to this thread... Thanks for providing your steps. They're incredibly similar to what I was doing, too. I am trying to get a workable answer/solution for you. I'll keep pok…

Ok @CarlosHleb -- here we go. I got it all to work together. I put it all up on my github repo here . The README.md should take you through it all and I think between what you have and what's on that github you should be able to get it all running. Here's the gist from that readme: To bring up thi…

Browzer with keycloack and self-signed certs

BrowZer

TheLumberjack June 14, 2024, 12:51pm 17

I'm covering this live on Ziti TV this week. If you're interested in seeing it live or watching the replay, it'll be here:

Topic		Replies	Views
BrowZer failed to start	26	137	October 23, 2024
How to install ziti Browzer in kubernetes?	30	268	January 8, 2025
Encount a problem when Install BrowZer with docker BrowZer	14	245	June 5, 2024
Deleting referenced auth policy gives unhandled 500 error & Browzer help BrowZer	18	113	May 3, 2025
Unable to use Browzer, looping refresh on Chrome General Questions	21	302	March 12, 2024

Browzer with keycloack and self-signed certs

Related topics