dear all, sorry for the long delay, coming back now. I am running in this kind of problem only when I modify the ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=zitiede-ctrl.ddns.net to a FQDN. When I am running with the default settings all is fine. Any hint for me?
user@overlay:~/.config/ziti/certs$ ziti edge quickstart
emitting a minimal PKI
Success
Using CA name: root-ca
Success
Using CA name: intermediate-ca
Success
Using CA name: intermediate-ca
Success
[ 3.227] WARNING ziti/controller/config.LoadConfig: this environment is using a default generated trust domain [spiffe://09de6b93c50bd0807295d7deac66cdbe5bdd8cdc], it is recommended that a trust domain is specified in configuration via URI SANs or the 'trustDomain' field
[ 3.227] WARNING ziti/controller/config.LoadConfig: this environment is using a default generated trust domain [spiffe://09de6b93c50bd0807295d7deac66cdbe5bdd8cdc], it is recommended that if network components have enrolled that the generated trust dom ain be added to the configuration field 'additionalTrustDomains' array when configuring a explicit trust domain
[ 3.233] INFO ziti/controller/db.RunMigrations.(*migrationManager).Migrate.func1: Migrated edge datastore from 0 to 37
[ 3.233] INFO ziti/controller/db.RunMigrations.(*migrationManager).Migrate.func1: edge datastore is up to date at version 37
[ 3.991] INFO ziti/common/metrics.ConfigureGoroutinesPoolMetrics.GoroutinesPoolMetricsConfigF.func1.1: {idleTime=[30s] maxQueueSize=[100] poolType=[pool.router.messaging] minWorkers=[0] maxWorkers=[100]} starting goroutine pool
[ 3.991] INFO ziti/controller/network.(*Network).showOptions: network = {
"CreateCircuitRetries": 2,
"CycleSeconds": 60,
"EnableLegacyLinkMgmt": false,
"InitialLinkLatency": 65000000000,
"IntervalAgeThreshold": 0,
"MetricsReportInterval": 60000000000,
"MinRouterCost": 10,
"PendingLinkTimeout": 10000000000,
"RouteTimeout": 10000000000,
"RouterConnectChurnLimit": 60000000000,
"RouterComm": {
"QueueSize": 100,
"MaxWorkers": 100
},
"Smart": {
"RerouteFraction": 0.02,
"RerouteCap": 4,
"MinCostDelta": 15
}
}
[ 3.991] INFO ziti/controller/webapis.NewFabricManagementApiFactory: initializing management api factory with 0 xmgmt instances
[ 3.991] INFO ziti/controller.(*Controller).showOptions: ctrl = {
"OutQueueSize": 4,
"MaxQueuedConnects": 1,
"MaxOutstandingConnects": 16,
"ConnectTimeout": 5000000000,
"DelayRxStart": false,
"WriteTimeout": 0,
"MessageStrategy": null,
"NewListener": null,
"AdvertiseAddress": {},
"RouterHeartbeatOptions": {
"sendInterval": 10000000000,
"checkInterval": 1000000000,
"closeUnresponsiveTimeout": 30000000000
},
"PeerHeartbeatOptions": {
"sendInterval": 10000000000,
"checkInterval": 1000000000,
"closeUnresponsiveTimeout": 30000000000
}
}
[ 3.991] INFO ziti/controller/server.NewController: edge controller instance id: cm6kxua910000lsmlh20lc7xv
[ 3.992] INFO ziti/controller.(*Controller).RegisterXmgmt: adding xmgmt *server.submgmt, enabled? true
[ 3.992] INFO ziti/controller/server.(*Controller).Initialize: initializing edge
[ 3.994] INFO ziti/controller/internal/policy.NewSessionEnforcer: {frequency=[5s] sessionTimeout=[30m0s]} session enforcer configured
[ 4.004] INFO ziti/controller/server.(*Controller).Shutdown: edge controller: shutting down...
[ 4.004] INFO ziti/controller/server.(*Controller).Shutdown: edge controller: stopped
[ 4.004] INFO ziti/controller/server.(*Controller).Shutdown: fabric controller: shutting down...
[ 4.004] INFO ziti/controller/server.(*Controller).Shutdown: fabric controller: stopped
[ 4.004] INFO ziti/controller/server.(*Controller).Shutdown: shutdown complete
[ 4.004] INFO ziti/controller/subcmd.NewEdgeInitializeCmd.func2: Ziti Edge initialization complete
Controller running... Configuring and starting Router...
[ 4.023] WARNING ziti/controller/config.LoadConfig: this environment is using a default generated trust domain [spiffe://09de6b93c50bd0807295d7deac66cdbe5bdd8cdc], it is recommended that a trust domain is specified in configuration via URI SANs or the 'trustDomain' field
[ 4.023] WARNING ziti/controller/config.LoadConfig: this environment is using a default generated trust domain [spiffe://09de6b93c50bd0807295d7deac66cdbe5bdd8cdc], it is recommended that if network components have enrolled that the generated trust dom ain be added to the configuration field 'additionalTrustDomains' array when configuring a explicit trust domain
[ 4.024] INFO ziti/ziti/controller.run: {build-date=[2024-10-02T12:59:41Z] go-version=[go1.23.1] os=[linux] revision=[0eec47ce3c80] nodeId=[client] arch=[amd64] version=[v1.1.15]} starting ziti-controller
[ 4.029] INFO ziti/controller/db.RunMigrations.(*migrationManager).Migrate.func1: edge datastore is up to date at version 37
[ 4.789] INFO ziti/common/metrics.ConfigureGoroutinesPoolMetrics.GoroutinesPoolMetricsConfigF.func1.1: {maxQueueSize=[100] maxWorkers=[100] idleTime=[30s] poolType=[pool.router.messaging] minWorkers=[0]} starting goroutine pool
[ 4.789] INFO ziti/controller/network.(*Network).showOptions: network = {
"CreateCircuitRetries": 2,
"CycleSeconds": 60,
"EnableLegacyLinkMgmt": false,
"InitialLinkLatency": 65000000000,
"IntervalAgeThreshold": 0,
"MetricsReportInterval": 60000000000,
"MinRouterCost": 10,
"PendingLinkTimeout": 10000000000,
"RouteTimeout": 10000000000,
"RouterConnectChurnLimit": 60000000000,
"RouterComm": {
"QueueSize": 100,
"MaxWorkers": 100
},
"Smart": {
"RerouteFraction": 0.02,
"RerouteCap": 4,
"MinCostDelta": 15
}
}
[ 4.789] INFO ziti/controller/webapis.NewFabricManagementApiFactory: initializing management api factory with 0 xmgmt instances
[ 4.789] WARNING ziti/controller/webapis.OverrideRequestWrapper: requestWrapper overridden more than once
[ 4.789] INFO ziti/controller.(*Controller).showOptions: ctrl = {
"OutQueueSize": 4,
"MaxQueuedConnects": 1,
"MaxOutstandingConnects": 16,
"ConnectTimeout": 5000000000,
"DelayRxStart": false,
"WriteTimeout": 0,
"MessageStrategy": null,
"NewListener": null,
"AdvertiseAddress": {},
"RouterHeartbeatOptions": {
"sendInterval": 10000000000,
"checkInterval": 1000000000,
"closeUnresponsiveTimeout": 30000000000
},
"PeerHeartbeatOptions": {
"sendInterval": 10000000000,
"checkInterval": 1000000000,
"closeUnresponsiveTimeout": 30000000000
}
}
[ 4.789] INFO ziti/controller/server.NewController: edge controller instance id: cm6kxuav70001lsmlju1yzkrx
[ 4.790] INFO ziti/controller.(*Controller).RegisterXmgmt: adding xmgmt *server.submgmt, enabled? true
[ 4.790] INFO ziti/controller/server.(*Controller).Initialize: initializing edge
[ 4.792] INFO ziti/controller/internal/policy.NewSessionEnforcer: {frequency=[5s] sessionTimeout=[30m0s]} session enforcer configured
[ 4.792] INFO ziti/controller/server.(*Controller).Run: starting edge
[ 4.792] INFO ziti/controller.(*Controller).Run.GoroutinesPoolMetricsConfigF.func1.1: {minWorkers=[1] idleTime=[10s] maxQueueSize=[1] maxWorkers=[16] poolType=[pool.listener.ctrl]} starting goroutine pool
[ 4.793] INFO channel/v3.(*UnderlayDispatcher).Run: started
[ 4.793] INFO ziti/controller/server.(*Controller).checkEdgeInitialized: edge initialized
[ 4.848] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[192.168.100.80:51664] error=[tls: client didn't provide a certificate]} handshake failed
[ 4.931] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[192.168.100.80:51670] error=[tls: client didn't provide a certificate]} handshake failed
[ 5.005] INFO xweb/v2.(*Server).Start: starting ApiConfig to listen and serve tls on 0.0.0.0:1280 for server client-management with APIs: [edge-management edge-client fabric]
[ 5.006] INFO ziti/controller/network.(*Network).Run: started
[ 5.015] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[192.168.100.80:51676] error=[tls: client didn't provide a certificate]} handshake failed
[ 5.099] INFO ziti/ziti/cmd/edge.(*QuickstartOpts).run: Controller online. Continuing...
[ 5.154] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[192.168.100.80:51698] error=[remote error: tls: bad certificate]} handshake failed
Untrusted certificate authority retrieved from server
Verified that server supplied certificates are trusted by server
Server supplied 2 certificates
Server certificate chain written to /home/user/.config/ziti/certs/zitiede-ctrl.ddns.net
RESTY 2025/01/31 15:47:49 ERROR Get "https://zitiede-ctrl.ddns.net:1280/edge/client/v1/version": tls: failed to verify certificate: x509: certificate is valid for localhost, ziti-controller, not zitiede-ctrl.ddns.net, Attempt 1
[ 5.254] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[192.168.100.80:51732] error=[remote error: tls: bad certificate]} handshake failed
RESTY 2025/01/31 15:47:49 ERROR Get "https://zitiede-ctrl.ddns.net:1280/edge/client/v1/version": tls: failed to verify certificate: x509: certificate is valid for localhost, ziti-controller, not zitiede-ctrl.ddns.net, Attempt 2
[ 5.385] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[192.168.100.80:51742] error=[remote error: tls: bad certificate]} handshake failed
RESTY 2025/01/31 15:47:49 ERROR Get "https://zitiede-ctrl.ddns.net:1280/edge/client/v1/version": tls: failed to verify certificate: x509: certificate is valid for localhost, ziti-controller, not zitiede-ctrl.ddns.net, Attempt 3
[ 5.536] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {remote=[192.168.100.80:51744] error=[remote error: tls: bad certificate]} handshake failed
RESTY 2025/01/31 15:47:49 ERROR Get "https://zitiede-ctrl.ddns.net:1280/edge/client/v1/version": tls: failed to verify certificate: x509: certificate is valid for localhost, ziti-controller, not zitiede-ctrl.ddns.net, Attempt 4
[ 5.787] ERROR transport/v2/tls.(*sharedListener).processConn [tls:0.0.0.0:1280]: {error=[remote error: tls: bad certificate] remote=[192.168.100.80:51752]} handshake failed
RESTY 2025/01/31 15:47:50 ERROR Get "https://zitiede-ctrl.ddns.net:1280/edge/client/v1/version": tls: failed to verify certificate: x509: certificate is valid for localhost, ziti-controller, not zitiede-ctrl.ddns.net, Attempt 5
