# How does LE certs work for Ziti Controller V2+?

**URL:** <https://openziti.discourse.group/t/how-does-le-certs-work-for-ziti-controller-v2/6088>\
**Category:** Uncategorized\
**Created:** [September 14, 2026, 1:03pm UTC](https://openziti.discourse.group/t/how-does-le-certs-work-for-ziti-controller-v2/6088 "2026-09-14T13:03:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dodo](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dodo/32/4343_2.png) [@Dodo](https://openziti.discourse.group/u/Dodo)\
**Post date:** [September 14, 2026, 1:03pm UTC](https://openziti.discourse.group/t/how-does-le-certs-work-for-ziti-controller-v2/6088/1 "2026-09-14T13:03:33Z")

</div>

Hello OpenZiti Team!

I noticed that my alt\_server\_certs no longer work for ziti controller v2.03. Is there a way to do this?

While I have tested using an identity block to setup LE certs under web section, I noticed that my remote access kept hitting a 4079 error as compared to using self-signed certificate.

Thanks,

Dodo

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [September 15, 2026, 1:13pm UTC](https://openziti.discourse.group/t/how-does-le-certs-work-for-ziti-controller-v2/6088/2 "2026-09-15T13:13:15Z")

</div>

Hi @Dodo, welcome to the community and to OpenZiti!

I did a bit of poking at this with my favorite LLM and it seems like it might be a regression. I don't know for sure just yet but I'll keep poking at it and let you know.

Thanks for pointing it out to us. They are supposed to work for sure so I'll have a look and follow up as soon as I can. Cheers

---

<div class="post-metadata">

**Author:** ![dmuensterer](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dmuensterer/32/2451_2.png) [@dmuensterer](https://openziti.discourse.group/u/dmuensterer)\
**Post date:** [September 15, 2026, 10:20pm UTC](https://openziti.discourse.group/t/how-does-le-certs-work-for-ziti-controller-v2/6088/3 "2026-09-15T22:20:01Z")

</div>

Hi Dodo,

`alt_server_certs ` seems to be working fine for us under v2.03:

```auto
$ echo | openssl s_client -connect le.zt.deltasecure.de:8441 -servername le.zt.deltasecure.de 2>/dev/null \
    | openssl x509 -noout -subject -issuer -dates -checkend 0
subject=CN=le.zt.deltasecure.de
issuer=C=US, O=Let's Encrypt, CN=YE2
notBefore=Aug 10 08:30:35 2026 GMT
notAfter=Nov 8 08:30:34 2026 GMT

```

```auto
$ curl -s https://le.zt.deltasecure.de:8441 | jq .data.version
"v2.0.3"

```

---

<div class="post-metadata">

**Author:** ![Dodo](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/dodo/32/4343_2.png) [@Dodo](https://openziti.discourse.group/u/Dodo)\
**Post date:** [September 16, 2026, 12:47am UTC](https://openziti.discourse.group/t/how-does-le-certs-work-for-ziti-controller-v2/6088/4 "2026-09-16T00:47:49Z")

</div>

Hello dmuensterer,

Thanks for helping out!

My previous setup was working flawlessly until an auto update on my Windows Ziti Desktop Edge cause an issue to connect back to my resources. Based on the old setup, my Ziti Server is v1.6.17 and the new Ziti Desktop Edge version is 2.11.3.2 Service v1.18.7.2 openssl. Because it kept failing, I scrap the entire setup and start afresh using quickstart instead.

The new setup is based on the following:

Ziti Server v2.0.3  
Windows Ziti Desktop Edge Ver 2.11.3.2 Service v1.18.7.2 openssl

Based on the configuration that I have used, external public domain display LetsEncrypt certificate correctly but I wasn't able to connect back to my resources. (Error code: 4079). Probably, my configuration might be wrong, maybe you can help take a look to see if you can spot any issues?

I have also tested using identity directly to pass LE certs to the address (public-domain-name), the cert was displayed correctly, unfortunately, I cannot connect back to my resource or register a newly created JWT token.

Reverting to self-signed certificates, everything works well though.

====Config====

identity: #Local-Certs - SDP is the perimeter between external and underlay  
cert: "pki/intermediate/certs/underlay-client.chain.pem"  
server\_cert: "pki/intermediate/certs/underlay.chain.pem"  
key: "pki/intermediate/keys/underlay.key"  
ca: "pki/root/certs/root.cert"

ctrl:  
options:  
advertiseAddress: tls:underlay.com:1280  
listener: tls:0.0.0.0:1280

edge:  
api:  
sessionTimeout: 30m  
address: overlay.com:1280  
enrollment:  
signingCert:  
cert: pki/intermediate/certs/intermediate.cert  
key: pki/intermediate/keys/intermediate.key  
edgeIdentity:  
duration: 180m  
edgeRouter:  
duration: 180m

web:

- name: client-management  
bindPoints:
  - interface: 0.0.0.0:1280  
address: overlay.com:1280  
identity: #Local-Certs  
cert: "pki/intermediate/certs/underlay-client.chain.pem"  
server\_cert: "pki/intermediate/certs/underlay.chain.pem"  
key: "pki/intermediate/keys/underlay.key"  
ca: "pki/intermediate/certs/intermediate.chain.pem"  
alt\_server\_certs: #Public-Certs
  - server\_cert: "pki/public/fullchain.pem"  
server\_key: "pki/public/privkey.pem"  
options:  
idleTimeout: 5000ms #http timeouts, new  
readTimeout: 5000ms  
writeTimeout: 100000ms  
minTLSVersion: TLS1.2  
maxTLSVersion: TLS1.3  
apis:
  - binding: edge-management  
options: { }
  - binding: edge-client  
options: { }
  - binding: fabric  
options: { }
  - binding: edge-oidc  
options: { }
  - binding: spa  
options:  
path: zac  
location: /opt/openziti/share/console  
indexFile: index.html

#Correction to my config.