To build on what Mike wrote, you'll also see this error pop out when using the ziti CLI since it usually will use username/password for auth and not, not certificate-based auth.
Another option you can take, would be to turn your control plane dark by separating it from the public and making it accessible exclusively via ziti itself. There's a Ziti TV on that https://www.youtube.com/watch?v=FI4byEDg344 and we actually discussed that a while back here Making ZAC dark - #23 by TheLumberjack as well.