Invalid ssl using ssl-passthrough in ziti controller

[qrkourier]

@sadath-12

I can control the access to mgmt in my domain to control the access to console

@sadath-12

it seems to solve the problem of hiding the console

Correct, you can restrict access to the managementApi cluster service for administrative management tasks with the console and CLI.

@sadath-12

I did try the alt ingress for clientapi . Wondering if there is one for ctrl plane as well

There's not because alt ingresses for client and mgmt APIs are for things like the console and BrowZer, not the router ctrl plane which always uses Ziti's edge signer PKI.

[sadath-12]

ok cool , that clears a lot . Thanks for the patience

[qrkourier]

You're welcome! Let us know if you have any more questions.

[sadath-12]

@qrkourier

Ziti identities and routers will continue to use the same old client API and router ctrl plane URLs (both are by default: {{ .Values.clientApi.advertisedHost }}:{{ .Values.clientApi.advertisedPort }}).

Hi @qrkourier, I tested this .

I'm wondering what would the client url be used for then ? since the jwt's decode to the client url itself but we really cant create identities .. etc using the url

[qrkourier]

@sadath-12

what would the client url be used for then ?

Ziti identities and routers use the client API to communicate with the Ziti controller with mutual TLS.

@sadath-12

the jwt's decode to the client url

Correct, a Ziti identity and a Ziti router one-time enrollment token both contain the URL of the client API as an issuer (iss) claim. Both submit their enrollment materials to this URL and receive a client certificate used to authenticate from that point forward.

@sadath-12

we really cant create identities .. etc using the url

There are no management operations available via the client API, only the management API. The client API and management API provide distinct sets of API operations. Either or both set may be "bound" to a web listener. For security, it's a good idea to bind the management API to a separate listener for which you control administrative access. That is where the CLI and console will connect. The client API provides public-facing operations so that all Ziti identities and all Ziti routers can connect to the controller with mutual TLS.