Controller doesn't start after 1.1.7 update

Support
1

I built my overlay network from the quickstart scripts around version 1.0.0. For fun I downloaded the 1.1.7 binary and dropped it in. My routers start ok but the controller won't start up and drops a hairy error.

panic: could not generate default trust domain: error generating default trust domain from root CA: no root CA detected after chain assembly from the root identity server cert and ca bundle

It seems like that specific check was recently added. I didn't deep-dive into how Go is processing the PKI. Wondering if my quickstart PKI will be unsuitable or if it's some other issue.

2

v1.1.6 introduced a requirement for a trust domain, and we're finding the default trust domain can't always be generated.

You can work around this by adding a line to your controller configuration YAML file.

trustDomain: my.ziti.cluster.namespace.example.com

This needs to be a unique value that complies with SPIFFE standard for a trust domain. The validation rules are similar to those for DNS names.

3

Seems like that did the trick. Controller updated to 1.1.7. Thank you!

1 Like