# Missing or Invalid CSR

**URL:** <https://openziti.discourse.group/t/missing-or-invalid-csr/2492>\
**Category:** General Questions\
**Created:** [April 30, 2024, 8:23am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492 "2024-04-30T08:23:24Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 8:23am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/1 "2024-04-30T08:23:24Z")

</div>

Hi all, I have been trying to setup OpenZiti for a couple of weeks and tried on 3 servers and I get the same error every time I try to add a Edge Tunnel.

So this is my environment:  
I have followed:

> **[Local - No Docker | OpenZiti](https://openziti.io/docs/learn/quickstarts/network/local-no-docker/?wizard)**
>
> This page will show you how to get your Ziti Network up and running

With 2 exceptions, I have setup a standard user called zitiadmin and run the installation steps as that user, the services are set to run as this user as well.  
Before the installation I set local variables (PATH) for installation folder and set that to /opt/openziti and I also set the External\_DNS to our public FQDN.

I also follow the guide to install the WebUI which is all working.  
I have also followed the guides to get the Edge Tuennel Service installed on a Ubuntu server and opened the required firewall ports, I also dont see any blocks in the firewall logs.

So I use the WebUI to create a new Router which generates and JWT file. I copy the file to the Edge Tunnel server and restart the services and I get this error:

Apr 30 08:09:17 t1s-mms-tun01 ziti-edge-tunnel.sh[3879098]: (3879098)[0.000] INFO ziti-sdk:utils.c:200 ziti\_log\_set\_level() set log level: root=3/INFO  
Apr 30 08:09:17 t1s-mms-tun01 ziti-edge-tunnel.sh[3879098]: (3879098)[0.000] INFO ziti-sdk:utils.c:169 ziti\_log\_init() Ziti C SDK version 0.35.12 @5acfb13(HEAD) starting at (202\>  
Apr 30 08:09:17 t1s-mms-tun01 ziti-edge-tunnel.sh[3879098]: (3879098)[0.000] INFO ziti-sdk:ziti\_enroll.c:88 ziti\_enroll() Ziti C SDK version 0.35.12 @5acfb13(HEAD) starting enro\>  
Apr 30 08:09:18 t1s-mms-tun01 ziti-edge-tunnel.sh[3879098]: (3879098)[0.113] WARN ziti-sdk:ziti\_ctrl.c:89 code\_to\_error() unmapped error code: MISSING\_OR\_INVALID\_CSR  
Apr 30 08:09:18 t1s-mms-tun01 ziti-edge-tunnel.sh[3879098]: (3879098)[0.113] ERROR ziti-sdk:ziti\_enroll.c:233 enroll\_cb() failed to enroll with controller: [https://T1S-MGS-ZTG01](https://T1S-MGS-ZTG01):\>  
Apr 30 08:09:18 t1s-mms-tun01 ziti-edge-tunnel.sh[3879098]: (3879098)[0.113] ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:2141 enroll\_cb() enrollment failed: MISSING\_OR\_INVALID\_CSR(\>  
Apr 30 08:09:18 t1s-mms-tun01 ziti-edge-tunnel.sh[3879094]: ERROR: failed to enroll MMS-Internal.jwt in /opt/openziti/etc/identities  
Apr 30 08:09:18 t1s-mms-tun01 systemd[1]: ziti-edge-tunnel.service: Control process exited, code=exited, status=1/FAILURE

Can anyone help me with this error?  
Many Thanks.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 30, 2024, 9:58am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/2 "2024-04-30T09:58:15Z")

</div>

Hi @mphayesuk, welcome to the community and to OpenZiti! I'm sorry you're having these troubles. The good news though is that this seems to be reproducible if you've done it three times and get the same issue.

This appears to be a ziti-edge-tunnel issue, can you provide a detailed set of instructions to reproduce the problem?

Can you let us know what OS you're running ziti-edge-tunnel on too and how you run it?

I admit, I don't think I've seen this issue before. I'm going to scan the forum for anything similar. Let us know about the os and steps to reproduce, thanks.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 30, 2024, 10:02am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/3 "2024-04-30T10:02:10Z")

</div>

One thing I just noticed is this error:

```auto
failed to enroll with controller: https://T1S-MGS-ZTG01:>

```

See how there's no port and it ends with a colon? This makes me think there's either a logging bug in the tunneler or there is a configuration issue with your controller, not advertising a port.

Can you also look into the controller and look at the config file to check the "address" entries in that file? Let's verify they're correct

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:07am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/4 "2024-04-30T10:07:03Z")

</div>

Hi @TheLumberjack, thanks for your quick response:

Am I looking in: T1S-MGS-ZTG01.yaml

And this section:  
ctrl:  
options:  
advertiseAddress: tls:T1S-MGS-ZTG01:6262

# (optional) settings

# set the maximum number of connect requests that are buffered and waiting to be acknowledged (1 to 5000, default 1)

#maxQueuedConnects: 1

# the maximum number of connects that have begun hello synchronization (1 to 1000, default 16)

#maxOutstandingConnects: 16

# the number of milliseconds to wait before a hello synchronization fails and closes the connection (30ms to 60000ms, default: 5000ms)

#connectTimeoutMs: 5000  
listener: tls:0.0.0.0:6262

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 30, 2024, 10:10am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/5 "2024-04-30T10:10:29Z")

</div>

There's another address in there in the Web section too. Check that too please?

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:10am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/6 "2024-04-30T10:10:39Z")

</div>

> [@TheLumberjack](#):
>
> `https://T1S-MGS-ZTG01`

Just in case its important:  
[https://t1s-mgs-ztg01:6262/](https://t1s-mgs-ztg01:6262/)  
Gives me an error of:

# This site can’t provide a secure connection

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:12am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/7 "2024-04-30T10:12:07Z")

</div>

web:

# name - required

# Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested.

- name: client-management
# bindPoints - required

# One or more bind points are required. A bind point specifies an interface (interface:port string) that defines

# where on the host machine the webListener will listen and the address (host:port) that should be used to

# publicly address the webListener(i.e. [mydomain.com](http://mydomain.com), localhost, 127.0.0.1). This public address may be used for

# incoming address resolution as well as used in responses in the API.
bindPoints:  
#interface - required
# A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces

  - interface: 0.0.0.0:1280
# address - required

# The public address that external incoming requests will be able to resolve. Used in request processing and

# response content that requires full host:port/path addresses.
address: T1S-MGS-ZTG01:1280

# identity - optional

# Allows the webListener to have a specific identity instead of defaulting to the root 'identity' section.
identity:  
ca: "/opt/openziti/T1SMGSZTG01/pki/T1S-MGS-ZTG01-edge-controller-root-ca/certs/T1S-MGS-ZTG01-edge-controller-root-ca.cert"  
key: "/opt/openziti/T1SMGSZTG01/pki/T1S-MGS-ZTG01-edge-controller-intermediate/keys/T1S-MGS-ZTG01-server.key"  
server\_cert: "/opt/openziti/T1SMGSZTG01/pki/T1S-MGS-ZTG01-edge-controller-intermediate/certs/T1S-MGS-ZTG01-server.chain.pem"  
cert: "/opt/openziti/T1SMGSZTG01/pki/T1S-MGS-ZTG01-edge-controller-intermediate/certs/T1S-MGS-ZTG01-client.cert"

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 30, 2024, 10:13am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/8 "2024-04-30T10:13:18Z")

</div>

Ok thanks. There's a port there, so the config looks ok... If you give me those steps to reproduce, I'll try in a bit.

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:13am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/9 "2024-04-30T10:13:23Z")

</div>

For [https://t1s-mgs-ztg01/](https://t1s-mgs-ztg01/)  
ERR\_CONNECTION\_REFUSED

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 30, 2024, 10:17am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/10 "2024-04-30T10:17:35Z")

</div>

Also, can you use openssl s\_client to conntect to port 1280 and 6262 from the tunneler machine?

```auto
openssl s_client -connect t1s-mgs-ztg01:1280 </dev/null
openssl s_client -connect t1s-mgs-ztg01:6262 </dev/null

```

both of those return certificate information?

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:24am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/11 "2024-04-30T10:24:30Z")

</div>

> [@TheLumberjack](#):
>
> `openssl s_client -connect t1s-mgs-ztg01:6262 </dev/null`

Ok, so 6262 was not open on the firewall, even though that never appeared in the logs as a blocked port (but thats my issue to solve)

Now I get a different error:  
Apr 30 10:23:11 t1s-mms-tun01 ziti-edge-tunnel.sh[3915701]: (3915701)[0.000] INFO ziti-sdk:utils.c:200 ziti\_log\_set\_level() set log level: root=3/INFO  
Apr 30 10:23:11 t1s-mms-tun01 ziti-edge-tunnel.sh[3915701]: (3915701)[0.000] INFO ziti-sdk:utils.c:169 ziti\_log\_init() Ziti C SDK version 0.35.12 @5acfb13(HEAD) starting at (2024-04-30T10:23:11.915)  
Apr 30 10:23:11 t1s-mms-tun01 ziti-edge-tunnel.sh[3915701]: (3915701)[0.000] ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:2196 enroll() failed to open file /opt/openziti/etc/identities/MMS-Internal.json: File exists(17)  
Apr 30 10:23:11 t1s-mms-tun01 ziti-edge-tunnel.sh[3915697]: ERROR: failed to enroll MMS-Internal.jwt in /opt/openziti/etc/identities  
Apr 30 10:23:11 t1s-mms-tun01 systemd[1]: ziti-edge-tunnel.service: Control process exited, code=exited, status=1/FAILURE

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:25am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/12 "2024-04-30T10:25:51Z")

</div>

root@t1s-mms-tun01:/opt/openziti/etc/identities# ls -lah  
total 12K  
drwxrwx--- 2 root ziti 4.0K Apr 30 10:23 .  
drwxr-xr-x 3 root root 4.0K Jan 16 10:56 ..  
-rw------- 1 ziti ziti 0 Apr 30 10:23 MMS-Internal.json  
-rw-rw---- 1 root ziti 994 Apr 30 08:09 MMS-Internal.jwt

---

<div class="post-metadata">

**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\
**Post date:** [April 30, 2024, 10:28am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/13 "2024-04-30T10:28:19Z")

</div>

The initialization script for ziti-edge-tunnel erroneously left an empty .json file when the previous enrollment attempt(s) failed. Can you remove the json file and restart ziti-edge-tunnel?

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:30am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/14 "2024-04-30T10:30:30Z")

</div>

Thanks, that fixed that error but now we go back to the same error as before:

Apr 30 10:29:01 t1s-mms-tun01 ziti-edge-tunnel.sh[3916934]: (3916934)[0.000] INFO ziti-sdk:utils.c:200 ziti\_log\_set\_level() set log level: root=3/INFO  
Apr 30 10:29:01 t1s-mms-tun01 ziti-edge-tunnel.sh[3916934]: (3916934)[0.000] INFO ziti-sdk:utils.c:169 ziti\_log\_init() Ziti C SDK version 0.35.12 @5acfb13(HEAD) starting at (2024-04-30T10:29:01.416)  
Apr 30 10:29:01 t1s-mms-tun01 ziti-edge-tunnel.sh[3916934]: (3916934)[0.000] INFO ziti-sdk:ziti\_enroll.c:88 ziti\_enroll() Ziti C SDK version 0.35.12 @5acfb13(HEAD) starting enrollment at (2024-04-30T10:29:01.416)  
Apr 30 10:29:01 t1s-mms-tun01 ziti-edge-tunnel.sh[3916934]: (3916934)[0.112] WARN ziti-sdk:ziti\_ctrl.c:89 code\_to\_error() unmapped error code: MISSING\_OR\_INVALID\_CSR  
Apr 30 10:29:01 t1s-mms-tun01 ziti-edge-tunnel.sh[3916934]: (3916934)[0.112] ERROR ziti-sdk:ziti\_enroll.c:233 enroll\_cb() failed to enroll with controller: [https://T1S-MGS-ZTG01:1280](https://T1S-MGS-ZTG01:1280) MISSING\_OR\_INVALID\_CSR (The supplied enroll\>  
Apr 30 10:29:01 t1s-mms-tun01 ziti-edge-tunnel.sh[3916934]: (3916934)[0.112] ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:2141 enroll\_cb() enrollment failed: MISSING\_OR\_INVALID\_CSR(-3)  
Apr 30 10:29:01 t1s-mms-tun01 ziti-edge-tunnel.sh[3916923]: ERROR: failed to enroll MMS-Internal.jwt in /opt/openziti/etc/identities  
Apr 30 10:29:01 t1s-mms-tun01 systemd[1]: ziti-edge-tunnel.service: Control process exited, code=exited, status=1/FAILURE

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [April 30, 2024, 10:31am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/15 "2024-04-30T10:31:47Z")

</div>

I bet the identity is burned. I bet it enrolled/consumed the .jwt but now that .jwt is not usable. Could you try removing the .jwt/.json files, make a new identity and see if that one will succeed?

In the UI, i would expect to see the identity and no "download" button. That would indicate the identity consumed the jwt, but the failure of port 6262 being closed, prevented the identity from being written...

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:35am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/16 "2024-04-30T10:35:55Z")

</div>

I have removed the old Identity and created a new one and copied the file over, but still the same error message.

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:36am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/17 "2024-04-30T10:36:36Z")

</div>

Build Debian 11 from Netinstall ISO

Standard tools with SSH server

_Make sure you have_ `tar` _,_ `hostname` _,_ `jq` _and_ `curl` _installed before running the_ `expressInstall` _one-liner._

Tar is gzip and is already installed,

As root

apt-get install jq curl git mlocate sudo

apt remove --assume-yes --purge apparmor

reboot

useradd -m zitiadmin -s /bin/bash

usermod -aG sudo zitiadmin

mkdir /opt/openziti

chown zitiadmin:zitiadmin /opt/openziti

**// Run the below nvm install as zitiadmin**

curl -o- [https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.3/install.sh](https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.3/install.sh) | bash

source ~/.bashrc

nvm list-remote

nvm install v20.12.2  
npm install -g @angular/cli@16

// Add the External\_DNS name to /etc/hosts file  
i.e.  
10.10.5.252 [xxx.xxx.co.uk](http://xxx.xxx.co.uk)

Set the below in home .bashrc files

Only set the External DNS and Home settings, the rest of them can be sorted out when you source the .env file in the openziti installation folder

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* USE THESE \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

export EXTERNAL\_DNS="[xxx.xxx.co.uk](http://xxx.xxx.co.uk)"

export ZITI\_HOME=”/opt/openziti/T1SMGSZTG01”

* * *

source /dev/stdin \<\<\< "$(wget -qO- [https://get.openziti.io/ziti-cli-functions.sh](https://get.openziti.io/ziti-cli-functions.sh))"; expressInstall

As root run:

source /opt/openziti/T1SMGSZTG01/T1S-MGS-ZTG01.env

source /dev/stdin \<\<\< "$(wget -qO- [https://get.openziti.io/ziti-cli-functions.sh](https://get.openziti.io/ziti-cli-functions.sh))"; createControllerSystemdFile "${ZITI\_CTRL\_NAME}"

source /dev/stdin \<\<\< "$(wget -qO- [https://get.openziti.io/ziti-cli-functions.sh](https://get.openziti.io/ziti-cli-functions.sh))"; createRouterSystemdFile "${ZITI\_ROUTER\_NAME}"

cd /opt/openziti/T1SMGSZTG01/

cp T1S-MGS-ZTG01.service /etc/systemd/system  
cp T1S-MGS-ZTG01-edge-router.service /etc/systemd/system

cd /etc/systemd/system

#update the user to zitiadmin

nano T1S-MGS-ZTG01-edge-router.service  
nano T1S-MGS-ZTG01-edge-router.service

systemctl daemon-reload  
systemctl enable --now T1S-MGS-ZTG01.service  
systemctl enable --now T1S-MGS-ZTG01-edge-router.service

**Install the Console Web UI**

As zitiadmin run the following:

source /opt/openziti/T1SMGSZTG01/T1S-MGS-ZTG01.env

git clone [GitHub - openziti/ziti-console](https://github.com/openziti/ziti-console.git) "${ZITI\_HOME}/ziti-console"

cd "${ZITI\_HOME}/ziti-console"

npm install

ng build ziti-console-lib // select n twice

ng build ziti-console-node

As root run:

source /opt/openziti/T1SMGSZTG01/T1S-MGS-ZTG01.env

ln -s "${ZITI\_PKI}/${ZITI\_CTRL\_EDGE\_NAME}-intermediate/certs/${ZITI\_CTRL\_EDGE\_ADVERTISED\_ADDRESS}-server.chain.pem" "${ZITI\_HOME}/ziti-console/server.chain.pem"

ln -s "${ZITI\_PKI}/${ZITI\_CTRL\_EDGE\_NAME}-intermediate/keys/${ZITI\_CTRL\_EDGE\_ADVERTISED\_ADDRESS}-server.key" "${ZITI\_HOME}/ziti-console/server.key"

Create the service and change the run as user to zitiadmin

source /dev/stdin \<\<\< "$(wget -qO- [https://get.openziti.io/ziti-cli-functions.sh](https://get.openziti.io/ziti-cli-functions.sh))"  
createZacSystemdFile

cp "${ZITI\_HOME}/ziti-console.service" /etc/systemd/system

systemctl daemon-reload  
systemctl enable --now ziti-console **systemctl status ziti-console --lines=0 --no-pager**

\*\*\* Double check all folder permissions to make sure zitiadmin is the owner

https://${ZITI\_CTRL\_EDGE\_ADVERTISED\_ADDRESS}:8443

Tunnel Agent Setup

Create user ziti and group ziti and add to sudo and run the below commands as ziti user

useradd -m ziti -s /bin/bash

groupadd ziti

usermod -aG sudo ziti  
usermod -aG ziti ziti

curl -sSLf [https://get.openziti.io/tun/scripts/install-ubuntu.bash](https://get.openziti.io/tun/scripts/install-ubuntu.bash) | bash

systemctl enable --now ziti-edge-tunnel.service

ziti-edge-tunnel add --jwt "$(\< ./in-file.jwt)" --identity myIdentityName

Log on to the controller

Create a new Edge Router – the only entry was the “Name”

**Load Identities Directory**

The tunneller will load all enrolled identities in the --identity-dir directory at startup. The default location for identities is is /opt/openziti/etc/identities.

Add enrolled identity files to this directory by copying the JSON file into the directory and setting permissions for group ziti.

chown -cR :ziti /opt/openziti/etc/identities

chmod -cR ug=rwX,o-rwx /opt/openziti/etc/identities

# package users can restart with systemd

systemctl restart ziti-edge-tunnel.service

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 10:38am UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/18 "2024-04-30T10:38:53Z")

</div>

Controller is on:  
root@T1S-MGS-ZTG01:/opt/openziti/T1SMGSZTG01# lsb\_release -a  
No LSB modules are available.  
Distributor ID: Debian  
Description: Debian GNU/Linux 11 (bullseye)  
Release: 11  
Codename: bullseye

Edge server I am trying to enroll is on:  
root@t1s-mms-tun01:/opt/openziti/etc/identities# lsb\_release -a  
No LSB modules are available.  
Distributor ID: Ubuntu  
Description: Ubuntu 20.04.4 LTS  
Release: 20.04  
Codename: focal

---

<div class="post-metadata">

**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\
**Post date:** [April 30, 2024, 6:48pm UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/19 "2024-04-30T18:48:35Z")

</div>

> [@mphayesuk](#):
>
> I have removed the old Identity and created a new one and copied the file over, but still the same error message.

From this I'm assuming you are copying the JWT into the identities directory on the host that's running ziti-edge-tunnel? Are you also doing the `ziti-edge-tunnel add` command that you showed in your setup steps?

Only one of these two actions is necessary. If you're doing both, I suspect the second step is failing (because the JWT has already been used), which would explain the empty json file.

---

<div class="post-metadata">

**Author:** ![mphayesuk](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mphayesuk](https://openziti.discourse.group/u/mphayesuk)\
**Post date:** [April 30, 2024, 9:06pm UTC](https://openziti.discourse.group/t/missing-or-invalid-csr/2492/20 "2024-04-30T21:06:45Z")

</div>

Hi, no I just copy the file and restart the service.

[Next page](https://openziti.discourse.group/t/missing-or-invalid-csr/2492.md?page=2)