How does LE certs work for Ziti Controller V2+?

Uncategorized
1

Hello OpenZiti Team!

I noticed that my alt_server_certs no longer work for ziti controller v2.03. Is there a way to do this?

While I have tested using an identity block to setup LE certs under web section, I noticed that my remote access kept hitting a 4079 error as compared to using self-signed certificate.

Thanks,

Dodo

2

Hi @Dodo, welcome to the community and to OpenZiti!

I did a bit of poking at this with my favorite LLM and it seems like it might be a regression. I don't know for sure just yet but I'll keep poking at it and let you know.

Thanks for pointing it out to us. They are supposed to work for sure so I'll have a look and follow up as soon as I can. Cheers

3

Hi Dodo,

alt_server_certs seems to be working fine for us under v2.03:

$ echo | openssl s_client -connect le.zt.deltasecure.de:8441 -servername le.zt.deltasecure.de 2>/dev/null \
    | openssl x509 -noout -subject -issuer -dates -checkend 0
subject=CN=le.zt.deltasecure.de
issuer=C=US, O=Let's Encrypt, CN=YE2
notBefore=Aug 10 08:30:35 2026 GMT
notAfter=Nov  8 08:30:34 2026 GMT

$ curl -s https://le.zt.deltasecure.de:8441 | jq .data.version
"v2.0.3"
4

Hello dmuensterer,

Thanks for helping out!

My previous setup was working flawlessly until an auto update on my Windows Ziti Desktop Edge cause an issue to connect back to my resources. Based on the old setup, my Ziti Server is v1.6.17 and the new Ziti Desktop Edge version is 2.11.3.2 Service v1.18.7.2 openssl. Because it kept failing, I scrap the entire setup and start afresh using quickstart instead.

The new setup is based on the following:

Ziti Server v2.0.3
Windows Ziti Desktop Edge Ver 2.11.3.2 Service v1.18.7.2 openssl

Based on the configuration that I have used, external public domain display LetsEncrypt certificate correctly but I wasn't able to connect back to my resources. (Error code: 4079). Probably, my configuration might be wrong, maybe you can help take a look to see if you can spot any issues?

I have also tested using identity directly to pass LE certs to the address (public-domain-name), the cert was displayed correctly, unfortunately, I cannot connect back to my resource or register a newly created JWT token.

Reverting to self-signed certificates, everything works well though.

====Config====

identity: #Local-Certs - SDP is the perimeter between external and underlay
cert: "pki/intermediate/certs/underlay-client.chain.pem"
server_cert: "pki/intermediate/certs/underlay.chain.pem"
key: "pki/intermediate/keys/underlay.key"
ca: "pki/root/certs/root.cert"

ctrl:
options:
advertiseAddress: tls:underlay.com:1280
listener: tls:0.0.0.0:1280

edge:
api:
sessionTimeout: 30m
address: overlay.com:1280
enrollment:
signingCert:
cert: pki/intermediate/certs/intermediate.cert
key: pki/intermediate/keys/intermediate.key
edgeIdentity:
duration: 180m
edgeRouter:
duration: 180m

web:

  • name: client-management
    bindPoints:
    • interface: 0.0.0.0:1280
      address: overlay.com:1280
      identity: #Local-Certs
      cert: "pki/intermediate/certs/underlay-client.chain.pem"
      server_cert: "pki/intermediate/certs/underlay.chain.pem"
      key: "pki/intermediate/keys/underlay.key"
      ca: "pki/intermediate/certs/intermediate.chain.pem"
      alt_server_certs: #Public-Certs
    • server_cert: "pki/public/fullchain.pem"
      server_key: "pki/public/privkey.pem"
      options:
      idleTimeout: 5000ms #http timeouts, new
      readTimeout: 5000ms
      writeTimeout: 100000ms
      minTLSVersion: TLS1.2
      maxTLSVersion: TLS1.3
      apis:
    • binding: edge-management
      options: { }
    • binding: edge-client
      options: { }
    • binding: fabric
      options: { }
    • binding: edge-oidc
      options: { }
    • binding: spa
      options:
      path: zac
      location: /opt/openziti/share/console
      indexFile: index.html

#Correction to my config.