# How to change sni? **URL:** \ **Category:** Ziti Overlay\ **Created:** [April 9, 2026, 7:50pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759 "2026-04-09T19:50:58Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 9, 2026, 7:50pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/1 "2026-04-09T19:50:58Z")
I am looking for guidance on the proper way to make Ziti use a new SNI hostname. After updating the _advertise_ hostname in the router configuration, the router fails to start. I modified the configuration as follows: ```auto listeners: - binding: transport bind: tls:0.0.0.0:port - advertise: tls:hostname.domain.org:port + advertise: tls:hostname_new.domain.org:port options: outQueueSize: 4 groups: @@ -50,7 +50,7 @@ listeners: - binding: edge address: tls:0.0.0.0:port options: - advertise: hostname.domain.org:port + advertise: hostname_new.domain.org:port connectTimeoutMs: 5000 getSessionTimeout: 60 ``` ```auto Apr 09 19:28:03 hostname ziti[2483479]: { "file":"github.com/openziti/ziti/router/env/config.go:925","func":"github.com/openziti/ziti/router/env.LoadConfigWithOptions", "level":"fatal", "msg":"one or more advertise addresses are invalid: [invalid link.listeners.advertise: tls:hostname51.domain.org:port, error: identity is not valid for provided host: [hostname_new.domain.org]. is valid for: [127.0.0.1, ::1, localhost, hostname, hostname.domain.org] invalid listeners.binding.advertise: hostname_new.domain.org:port, error: identity is not valid for provided host: [hostname_new.domain.org]. is valid for: [127.0.0.1, ::1, localhost, hostname, hostname.domain.org]]", "time":"2026-04-09T19:28:03.548Z" } ``` ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 9, 2026, 8:21pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/2 "2026-04-09T20:21:32Z")
I think you are looking for `newAddress` and `newListener`. See [the Release 0.24.5 changelog entry](https://github.com/openziti/ziti/blob/7455debf652c1d5ec99f4c80d98a084e3b6f014e/changelogs/CHANGELOG.0.24.md#support-controller-address-changes) and see if that's what you are looking for? ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 9, 2026, 8:33pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/3 "2026-04-09T20:33:25Z")
Thank you for the notes regarding updating the controller. In my case, however, the controller IP/DNS remains unchanged. I only need to update the router’s SNI name, i.e. the DNS name used by Ziti fabric/clients when sending the TLS ClientHello. This is the router’s advertised DNS name. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 9, 2026, 8:38pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/4 "2026-04-09T20:38:29Z")
Oh, I misunderstood. For a router, you would create a new server certificate valid for your new domain and update the advertised address accordingly. I see now from your error that you have missed that first part. The certificate needs to be valid for `new.domain.org` and it's not. ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 9, 2026, 8:40pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/5 "2026-04-09T20:40:57Z")
Thank you. I must have missed this point entirely. Could you please point me to where I can read how to do this, any relevant documentation? Since there are service policies in place, I would prefer to avoid recreating the router. Do you mean I need to re-enroll the router? ```auto ziti edge re-enroll edge-router -o ziti router enroll -j ``` Does it preserve the ziti identity of the router? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 15, 2026, 1:37pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/6 "2026-04-15T13:37:36Z")
I would expect re-enrolling it would work, yes. I would then stop the router, remove the router's PKI, update the routers config with the new SNI, then re-enroll the router. I think that'd work ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [April 18, 2026, 3:25pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/7 "2026-04-18T15:25:59Z")
Many routers have a Ziti identity, as they operate as tunnels. I hope that running `ziti edge re-enroll` will be sufficient—would that be correct? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 19, 2026, 8:19pm UTC](https://openziti.discourse.group/t/how-to-change-sni/5759/8 "2026-04-19T20:19:23Z")
yes. i expect it to work as you want