# How to re-enroll zrok's public?
**URL:** https://openziti.discourse.group/t/how-to-re-enroll-zroks-public/4457
**Category:** zrok
**Created:** [April 29, 2025, 11:00pm UTC](https://openziti.discourse.group/t/how-to-re-enroll-zroks-public/4457 "2025-04-29T23:00:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)
#### Post date: [April 29, 2025, 11:00pm UTC](https://openziti.discourse.group/t/how-to-re-enroll-zroks-public/4457/1 "2025-04-29T23:00:30Z")
I have created _public_ on the first HA controller. All routers have been created and enrolled on the second controller.
The first HA controller is now off. So I have changed manually ztAPI in .zrok/identities/public.json Unfortunately the routers do not accept the frontend’s certificate issued by the first controller.
This is strange however. In the reference [example](https://openziti.io/docs/reference/ha/bootstrapping/certificates) the ziti controllers have different intermediate certificates. I see that the _public's_ certificate does not have URI:spiffe://domain.name. So _public_ can not migrate to another controller. On the other hand _public_ is unique identity in zrok.
Apparently the command _zrok admin create frontend_ does not generate the identity file .zrok/identities/public.json.
Anyway the certificate issued to _public_ is a 1 year certificate. So there should be a way to re-enroll _public_ if I understand correctly.
Is it safe to delete the identity using ZAC? I have two propositions:
1. The first option is to run the _zrok admin bootstrap etc/ctrl.yml_ ? Will bootstrap keep the zrok database?
2. The second option is to run [bootstrap-frontend.bash](https://github.com/openziti/zrok/blob/v1.0.2/docker/compose/zrok-instance/bootstrap-frontend.bash)
---
### Author:  [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)
#### Post date: [May 1, 2025, 11:16am UTC](https://openziti.discourse.group/t/how-to-re-enroll-zroks-public/4457/2 "2025-05-01T11:16:06Z")
[bootstrap-frontend.bash](https://github.com/openziti/zrok/blob/v1.0.2/docker/compose/zrok-instance/bootstrap-frontend.bash) has done the work. Thank you.
But the script does not edit the edge router policy. So we need to change the policy manually using ZAC.
```auto
[68.330] WARNING sdk-golang/ziti.(*ContextImpl).createSession: {error=[error for request KneOg6w6u: NO_EDGE_ROUTERS_AVAILABLE: No edge routers are assigned and online to handle the requested connection] errorType=[*rest_util.APIFormattedError]} failure creating Dial session to service htosd0wff4x7
```
---
### Author:  [@qrkourier](https://openziti.discourse.group/u/qrkourier)
#### Post date: [May 1, 2025, 1:23pm UTC](https://openziti.discourse.group/t/how-to-re-enroll-zroks-public/4457/3 "2025-05-01T13:23:06Z")
> [@Rantanplan](#):
>
> 1. The first option is to run the _zrok admin bootstrap etc/ctrl.yml_ ? Will bootstrap keep the zrok database?
It's safe to re-run `zrok admin bootstrap`. It's non-destructive and will create missing entities in Ziti.
> [@Rantanplan](#):
>
> [bootstrap-frontend.bash](https://github.com/openziti/zrok/blob/v1.0.2/docker/compose/zrok-instance/bootstrap-frontend.bash) has done the work. Thank you. But the script does not edit the edge router policy.
Yes, the script assumes it is setting up a single public frontend with the default name "public" for a dedicated Ziti network with a standalone (not clustered) Ziti controller. I expect a future Linux service package for zrok that incorporates the ideas from that Docker self-hosting script I shared, and I'm glad you were able to reference that to see how to complete the Linux self-hosting setup!
We're working on shipping lots of changes for Ziti clustered mode right now, so the zrok enhancements for Linux are surely a few months out, at least.
---
### Author:  [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)
#### Post date: [May 1, 2025, 2:01pm UTC](https://openziti.discourse.group/t/how-to-re-enroll-zroks-public/4457/4 "2025-05-01T14:01:56Z")
Zrok is a very nice application. It was a good idea to create it, certainly. What his name stands for?
Just to add a few of details.
I have renamed the identity, _public_-\>_public\_010525_.
Zac has modified the edge router policy _public_.
At this point there is no identity _public_. But there is the edge router policy _public_ with _public\_010525_.
Then I run the _bootstap-frontend.bash_. The script creates _public_ and enrolls it. But keeps the edge router policy _public_ as it was. So we need to edit the policy manually
```auto
"identityRoles": [
"@ks78qgkgo"
],
"identityRolesDisplay": [
{
"name": "@public",
"role": "@ks78qgkgo"
}
```
---
### Author:  [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)
#### Post date: [May 1, 2025, 8:10pm UTC](https://openziti.discourse.group/t/how-to-re-enroll-zroks-public/4457/5 "2025-05-01T20:10:16Z")
> [@qrkourier](#):
>
> the script assumes it is setting up a single public frontend with the default name "public"
Having a single _public_ identity is enough, since the frontends are stateless. It works pretty well, indeed.
The only problem is the _public_'s certificate. From my perspective the certificate could contain URI:spiffe://domain.name/controller/frontend in order to be accepted by another HA controller/routers.
Otherwise if the original controller where we have created and enrolled _public_, is stopped _public_ can not connect. So we should remove the identity and create and enroll _public_ again on second controller.