# Got a error for identity enrollment **URL:** \ **Category:** Ziti Desktop Edge for Windows\ **Created:** [May 30, 2024, 8:22am UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619 "2024-05-30T08:22:40Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![git321906241](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/git321906241/32/2101_2.png) [@git321906241](https://openziti.discourse.group/u/git321906241)\ **Post date:** [May 30, 2024, 8:22am UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/1 "2024-05-30T08:22:40Z")
I follow the quickstart to set up a local - no docker network,and ZAC was successfully. But when I Enrolling the identity for ziti Desktop Edgeford Windos, its wrong ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/0/0d763eb9db89ce55a447eca893f499215922ca41.png) service logs [2024-05-30T07:52:45.059Z] ERROR ziti-sdk:ziti\_ctrl.c:164 ctrl\_resp\_cb() ctrl[ChanDa] request failed: -4039(connection timed out) [2024-05-30T07:52:45.059Z] ERROR ziti-sdk:ziti\_enroll.c:221 well\_known\_certs\_cb() D:/a/ziti-tunnel-sdk-c/ziti-tunnel-sdk-c/build/\_deps/ziti-sdk-c-src/library/ziti\_enroll.c:139 - ZITI\_JWT\_VERIFICATION\_FAILED =\> -7 (JWT verification failed) [2024-05-30T07:52:45.059Z] ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:319 tunnel\_enroll\_cb() enrollment failed: CONTROLLER\_UNAVAILABLE(-7) The identity is simply set with an attribute I saw a similar problem，but the difference is that I'm not using docker [Enrollment Failed ZDEW - Tunneler Apps / Ziti Desktop Edge for Windows - openziti](https://openziti.discourse.group/t/enrollment-failed-zdew/935/11) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [May 30, 2024, 11:36am UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/2 "2024-05-30T11:36:29Z")
Hi @git321906241, welcome to the community and to OpenZiti! The failed to enroll `ZITI_JWT_VERIFICATION_FAILED => -7 (JWT verification failed)` makes me think the PKI is somehow incorrect. Can you describe where the controller is installed? Is it in WSL or is it on a linux machine somewhere or something else entirely? How'd you install it? Could you try using the ziti cli to enroll a test identify first and see what it returns? You would just run: ```auto ziti edge create identity test-enroll -o test-enroll.jwt ziti edge enroll test-enroll.jwt ``` You SHOULD see something like this (then you can just delete this identity): ```auto INFO generating 4096 bit RSA key INFO enrolled successfully. identity file written to: test-enroll.json ``` If you don't please show me the output? Let's take the ZDEW out of the picture, it's a bit easier to use the ziti CLI to test/debug here. ---
**Author:** ![git321906241](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/git321906241/32/2101_2.png) [@git321906241](https://openziti.discourse.group/u/git321906241)\ **Post date:** [May 31, 2024, 2:29am UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/3 "2024-05-31T02:29:35Z")
Thanks for your reply, my controller installs on WSL, i use the ziti cli to enroll a identify,the expected results were returned > INFO generating 4096 bit RSA key > INFO enrolled successfully. identity file written to: test-enroll.json I tested it with other devices.Both computers in the same LAN can successfully enroll identities, but the host of WSL or cloud server both can't enroll identities, and my WSL, host, and cloud server firewall have been turned off,do you have any suggestions? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [May 31, 2024, 1:59pm UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/4 "2024-05-31T13:59:36Z")
From the windows computer, what is the hostname/FQDN that it uses to connect to the controller? For example, on my computer when I run ziti in docker (through WSL), from my command prompt I access the controller with: ```auto C:\Users\clint>curl -sk https://sg4u22wsl.parkplace-via-dhcp:12000 ``` which returns some json for me ```auto {"data":{"apiVersions":{"edge":{"v1":{"apiBaseUrls":["https://sg4u22wsl.parkplace-via-dhcp:12000/edge/client/v1"],"path":"/edge/client/v1"}},"edge-client":{"v1":{"apiBaseUrls":["https://sg4u22wsl.parkplace-via-dhcp:12000/edge/client/v1"],"path":"/edge/client/v1"}},"edge-management":{"v1":{"apiBaseUrls":["https://sg4u22wsl.parkplace-via-dhcp:12000/edge/management/v1"],"path":"/edge/management/v1"}}},"buildDate":"2024-04-10T19:42:37Z","capabilities":[],"revision":"a3186132e5eb","runtimeVersion":"go1.22.2","version":"v1.0.0"},"meta":{}} ``` That domain name needs to show up in your controller's cert. The easiest way to check that imo is using your browser. You need to check the "Certificate Subject Alternate Name" and you need a "DNS Name" that matches. ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/f/f46f969923c8f04c1ea7fbd54c6a202de0384193.png) Can you confirm that your windows machine can get to that controller in the browser and that you see a DNS Name that matches the url you go to? (as I show) ---
**Author:** ![git321906241](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/git321906241/32/2101_2.png) [@git321906241](https://openziti.discourse.group/u/git321906241)\ **Post date:** [June 2, 2024, 3:38pm UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/5 "2024-06-02T15:38:00Z")
there is json ``` {"data":{"apiVersions":{"edge":{"v1":{"apiBaseUrls":["https://ChanDa:1280/edge/client/v1"],"path":"/edge/client/v1"}},"edge-client":{"v1":{"apiBaseUrls":["https://ChanDa:1280/edge/client/v1"],"path":"/edge/client/v1"}},"edge-management":{"v1":{"apiBaseUrls":["https://ChanDa:1280/edge/management/v1"],"path":"/edge/management/v1"}}},"buildDate":"2024-04-10T19:42:37Z","capabilities":[],"revision":"a3186132e5eb","runtimeVersion":"go1.22.2","version":"v1.0.0"},"meta":{}} ``` I can't get to the controller like [https://ChanDa:1280](https://ChanDa:1280) in the browser ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 2, 2024, 3:43pm UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/6 "2024-06-02T15:43:40Z")
That's what I was afraid of/expected. If you're running ziti inside WSL, you'll have to figure out how to get wsl and windows to play nicely together. I won't lie -- it's sort of a pain even for me. Nothing ziti related, just all about how Microsoft implemented WSL. Me personally, I use their undocumented "bridge" network feature of WSL and I also have a pi.hole that controls my local DNS but that's all... "work"... I find it useful, but it's all stuff that's outside of anything OpenZiti.... I would recommend you either: - install ziti on a different computer in your local network (then routing won't be an issue) - install a VM with hyper-v or oracle virtual box and use one of THOSE VM's in "bridge" mode - install ziti somewhere else outside your network on a free VPS like oracle, or a cloud server you have - make it only work for you workstation by using the hosts file in windows and have it point ChanDa to 127.0.0.1 The problem right now is the WSL hostname `ChanDa` is not resolvable by windows... You need to get that working first though ---
**Author:** ![git321906241](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/git321906241/32/2101_2.png) [@git321906241](https://openziti.discourse.group/u/git321906241)\ **Post date:** [June 2, 2024, 4:08pm UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/7 "2024-06-02T16:08:11Z")
thank you,i will try ---
**Author:** ![git321906241](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/git321906241/32/2101_2.png) [@git321906241](https://openziti.discourse.group/u/git321906241)\ **Post date:** [June 3, 2024, 1:34am UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/8 "2024-06-03T01:34:18Z")
I replaced the device and installed Linux, successfully accessed the controller, "Certificate Subject Alternate Name" is correct, ECS in the Internet still cannot enroll their identities, what should I do next ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 3, 2024, 1:56am UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/9 "2024-06-03T01:56:53Z")
You need to look at the logs and find the error. it should be obvious, but if it's not obvious, post them here. ---
**Author:** ![git321906241](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/git321906241/32/2101_2.png) [@git321906241](https://openziti.discourse.group/u/git321906241)\ **Post date:** [June 3, 2024, 2:49am UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/10 "2024-06-03T02:49:19Z")
``` [2024-06-03T02:04:42.484Z] ERROR ziti-sdk:ziti_ctrl.c:164 ctrl_resp_cb() ctrl[chanda-ThinkBook-16-G4-IAP] request failed: -3008(unknown node or service) [2024-06-03T02:04:42.484Z] ERROR ziti-sdk:ziti_enroll.c:221 well_known_certs_cb() D:/a/ziti-tunnel-sdk-c/ziti-tunnel-sdk-c/build/_deps/ziti-sdk-c-src/library/ziti_enroll.c:139 - ZITI_JWT_VERIFICATION_FAILED => -7 (JWT verification failed) [2024-06-03T02:04:42.484Z] ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:319 tunnel_enroll_cb() enrollment failed: CONTROLLER_UNAVAILABLE(-7) ``` "unknown node or service",this is a different departure from the previous mistake, the problem appears to be that the public network cannot resolve the private DNS, do I need to change the configuration to map the controller service to the Internet? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 4, 2024, 4:02pm UTC](https://openziti.discourse.group/t/got-a-error-for-identity-enrollment/2619/11 "2024-06-04T16:02:37Z")
Yes, "unknown node or service" in my experience, means the computer cannot resolve the DNS entry > do I need to change the configuration to map the controller service to the Internet? Does this mean you're deploying in kubernetes? I can't really tell you "what" needs to happen there but I can tell you that the ZDEW (ziti desktop edge for windows) needs to be able to: - resolve the "advertised" address of the controller - be able to connect to the controller client http api - resolve the "advertised" address of at least one edge router - be able to connect to the edge port advertised by the edge router