# Host OpenZiti Anywhere Unable to enroll

**URL:** <https://openziti.discourse.group/t/host-openziti-anywhere-unable-to-enroll/2301>\
**Category:** Support\
**Created:** [March 18, 2024, 7:53am UTC](https://openziti.discourse.group/t/host-openziti-anywhere-unable-to-enroll/2301 "2024-03-18T07:53:44Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [March 22, 2024, 12:21pm UTC](https://openziti.discourse.group/t/host-openziti-anywhere-unable-to-enroll/2301/11 "2024-03-22T12:21:46Z")

</div>

I got on a call with @McGonagall666 last night and we did some troubleshooting. it turns out SNI-based TLS connections were being reset immediately for reasons I don't understand. If anyone else comes across this discourse post, make sure you can use opessl to connect to your controller/router/etc and ensure you see certificates returned.

To diagnose - use the IP of your host:

> openssl s\_client -connect 3.18.113.172:8441 \</dev/null

The result **must be nearly identical** to what you see when you use the DNS:

> openssl s\_client -connect [ec2-3-18-113-172.us-east-2.compute.amazonaws.com:8441](http://ec2-3-18-113-172.us-east-2.compute.amazonaws.com:8441) \</dev/null

When I tried this, the SSL handshake changes a tiny bit:

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/7/79af021d31da51f3a6e95939140aecdfaabbe4fe.png)

---

_[View the full topic](https://openziti.discourse.group/t/host-openziti-anywhere-unable-to-enroll/2301)._