I attempted to use OpenSSL to simulate the creation of PKI certificates. Currently, the controller can start normally, and ZAC is able to manage it as well. However, I created an AP-router, and after successfully registering it, an error occurred during startup. I'm not sure if it's due to an issue with the certificates, but if there were a problem with the certificates, why doesn't the controller report any errors?
Here is the error log when the router starts:
root@ip-10-111-0-5:/opt/zt# ztbin/ziti router run /opt/zt/ap-router.yaml
[ 0.016] INFO ziti/ziti/router.run: {revision=[0eec47ce3c80] build-date=[2024-10-02T12:59:41Z] routerId=[VefibBTkJx] configFile=[/opt/zt/ap-router.yaml] go-version=[go1.23.1] os=[linux] arch=[amd64] version=[v1.1.15]} starting ziti router
....
[ 2.777] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {endpoint=[tls:zt.demo.org:8440] error=[error connecting ctrl (EOF)]} unable to connect controller
[ 3.428] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {error=[error connecting ctrl (EOF)] endpoint=[tls:zt.demo.org:8440]} unable to connect controller
[ 4.900] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {endpoint=[tls:zt.demo.org:8440] error=[error connecting ctrl (EOF)]} unable to connect controller
[ 7.587] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {error=[error connecting ctrl (EOF)] endpoint=[tls:zt.demo.org:8440]} unable to connect controller
[ 9.637] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {error=[error connecting ctrl (EOF)] endpoint=[tls:zt.demo.org:8440]} unable to connect controller
[ 12.113] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {endpoint=[tls:zt.demo.org:8440] error=[error connecting ctrl (EOF)]} unable to connect controller
[ 17.532] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {endpoint=[tls:zt.demo.org:8440] error=[error connecting ctrl (EOF)]} unable to connect controller
^C[ 18.793] INFO ziti/ziti/router.waitForShutdown: shutting down ziti router
[ 18.794] INFO transport/v2/tls.(*sharedListener).runAccept [tls:0.0.0.0:10080]: {error=[accept tcp [::]:10080: use of closed network connection]} listener closed, exiting
[ 18.794] INFO transport/v2/tls.(*sharedListener).runAccept [tls:0.0.0.0:10080]: exited
[ 18.794] INFO ziti/router/link.(*linkRegistryImpl).Shutdown: {linkCount=[0]} shutdown links in link registry
[ 18.794] INFO transport/v2/tls.(*sharedListener).runAccept [tls:0.0.0.0:8442]: {error=[accept tcp [::]:8442: use of closed network connection]} listener closed, exiting
[ 18.794] INFO transport/v2/tls.(*sharedListener).runAccept [tls:0.0.0.0:8442]: exited
[ 18.794] ERROR agent.(*handler).listen: {error=[accept unix /tmp/gops-agent.22579.sock: use of closed network connection]} error accepting gops connection, closing gops listener
[ 18.794] ERROR agent.(*handler).listen.func1: {error=[close unix /tmp/gops-agent.22579.sock: use of closed network connection]} error closing gops listener
[ 18.794] ERROR ziti/router/forwarder.(*Faulter).run: exited
[ 18.794] WARNING ziti/router/forwarder.(*Scanner).run: exited
[ 18.794] ERROR ziti/router/xgress_edge.(*Acceptor).Run: error accepting (closed)
[ 18.794] WARNING ziti/router/xgress_edge.(*Acceptor).Run: exiting
^C^C^C[ 25.795] ERROR ziti/router/env.(*networkControllers).connectToControllerWithBackoff.func2: {endpoint=[tls:zt.demo.org:8440] error=[error connecting ctrl (EOF)]} unable to connect controller
I briefly checked the information:
root@ip-10-111-0-5:/opt/zt# telnet zt.demo.org 8440
Trying X.X.X.X...
Connected to zt.demo.org.
Escape character is '^]'.
^]
telnet> quit
root@ip-10-111-0-5:/opt/zt# telnet zt.demo.org 8441
Trying X.X.X.X...
Connected to zt.demo.org.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
root@ip-10-111-0-5:/opt/zt# curl -k https://zt.demo.org:8441
{"data":{"apiVersions":{"edge":{"v1":{"apiBaseUrls":["https://zt.demo.org:8441/edge/client/v1"],"path":"/edge/client/v1"}},"edge-client":{"v1":{"apiBaseUrls":["https://zt.demo.org:8441/edge/client/v1"],"path":"/edge/client/v1"}},"edge-management":{"v1":{"apiBaseUrls":["https://zt.demo.org:8441/edge/management/v1"],"path":"/edge/management/v1"}}},"buildDate":"2024-10-02T12:59:41Z","capabilities":[],"revision":"0eec47ce3c80","runtimeVersion":"go1.23.1","version":"v1.1.15"},"meta":{}}
root@ip-10-111-0-5:/opt/zt# cat ap-router.yaml
v: 3
identity: cert: "/opt/zt/ap-router.cert"
server_cert: "/opt/zt/ap-router.server.chain.cert"
key: "/opt/zt/ap-router.key"
ca: "/opt/zt/ap-router.cas"
#alt_server_certs:
# - server_cert: ""
# server_key: ""
ctrl:
endpoint: tls:zt.demo.org:8440
link:
dialers:
- binding: transport
listeners:
- binding: transport
bind: tls:0.0.0.0:10080
advertise: tls:zt.demo.org:10080
options:
outQueueSize: 4
listeners:
# bindings of edge and tunnel requires an "edge" section below
- binding: edge
address: tls:0.0.0.0:8442 options: advertise: zt.demo.org:8442 connectTimeoutMs: 5000
getSessionTimeout: 60
- binding: tunnel
options:
mode: host #tproxy|host
edge:
csr:
country: US
province: NC
locality: Charlotte
organization: NetFoundry
organizationalUnit: Ziti
sans:
dns:
- localhost
- zt.demo.org
ip:
- "127.0.0.1"
- "::1"
#transport:
# ws:
# writeTimeout: 10
# readTimeout: 5
# idleTimeout: 120
# pongTimeout: 60
# pingInterval: 54
# handshakeTimeout: 10
# readBufferSize: 4096
# writeBufferSize: 4096
# enableCompression: true
forwarder:
latencyProbeInterval: 0
xgressDialQueueLength: 1000
xgressDialWorkerCount: 128
linkDialQueueLength: 1000
linkDialWorkerCount: 32
root@ip-10-111-0-5:/opt/zt# cat ap-router.yaml
v: 3
identity: cert: "/opt/zt/ap-router.cert"
server_cert: "/opt/zt/ap-router.server.chain.cert"
key: "/opt/zt/ap-router.key"
ca: "/opt/zt/ap-router.cas"
#alt_server_certs:
# - server_cert: ""
# server_key: ""
ctrl:
endpoint: tls:zt.demo.org:8440
link:
dialers:
- binding: transport
listeners:
- binding: transport
bind: tls:0.0.0.0:10080
advertise: tls:zt.demo.org:10080
options:
outQueueSize: 4
listeners:
# bindings of edge and tunnel requires an "edge" section below
- binding: edge
address: tls:0.0.0.0:8442 options: advertise: zt.demo.org:8442 connectTimeoutMs: 5000
getSessionTimeout: 60
- binding: tunnel
options:
mode: host #tproxy|host
edge:
csr:
country: US
root@ip-10-111-0-5:/opt/zt# cat zt.demo.org.yaml
v: 3
db: data/ctrl.db
identity:
cert: /opt/zt/pki/zt.demo.org-mid/certs/zt.demo.org-client.chain.pem
server_cert: /opt/zt/pki/zt.demo.org-mid/certs/zt.demo.org-server.chain.pem
key: /opt/zt/pki/zt.demo.org-mid/keys/zt.demo.org-server.key
ca: /opt/zt/pki/cas.pem
ctrl:
options:
advertiseAddress: tls:zt.demo.org:8440
listener: tls:0.0.0.0:8440
healthChecks:
boltCheck:
interval: 30s
timeout: 20s
initialDelay: 30s
edge:
api:
sessionTimeout: 30m
address: zt.demo.org:8441
enrollment:
signingCert:
cert: /opt/zt/pki/signing.pem
key: /opt/zt/pki/zt.demo.org-signing-mid/keys/zt.demo.org-signing-mid.key
edgeIdentity:
duration: 180m
edgeRouter:
duration: 180m
web:
- name: client-management
bindPoints:
- interface: 0.0.0.0:8441
address: zt.demo.org:8441
identity:
ca: /opt/zt/pki/zt.demo.org-edge-controller-root-ca/certs/zt.demo.org-edge-controller-root-ca.cert
key: /opt/zt/pki/zt.demo.org-edge-controller-mid/keys/zt.demo.org-server.key
server_cert: /opt/zt/pki/zt.demo.org-edge-controller-mid/certs/zt.demo.org-server.chain.pem
cert: /opt/zt/pki/zt.demo.org-edge-controller-mid/certs/zt.demo.org-client.chain.pem
options:
readTimeout: 5000ms
writeTimeout: 100000ms
minTLSVersion: TLS1.2
maxTLSVersion: TLS1.3
apis:
- binding: edge-management
options: { }
- binding: edge-client
options: { }
- binding: fabric
options: { }
OpenSSL Certificate Creation Method:
Root Certificate
openssl genrsa -out "$CA_KEY" $KEY_SIZE || exit_on_error "Root CA key generation"
openssl req -new -x509 -days $DAYS -key "$CA_KEY" -out "$CA_CTR" -subj "$SUBJ" \
-extensions v3_ca -config <(cat /etc/ssl/openssl.cnf <(printf "[v3_ca]\nkeyUsage=critical,cRLSign,keyCertSign\nbasicConstraints=critical,CA:TRUE")) || exit_on_error "Root CA certificate generation"
Grandparent Certificate and Intermediate Certificate
openssl genrsa -out "$CA_KEY" $KEY_SIZE || exit_on_error "CA key generation"
openssl req -new -key "$CA_KEY" -out "$CA_CSR" -subj "$SUBJ" || exit_on_error "CA CSR generation"
openssl x509 -req -in "$CA_CSR" -CA "$PARENT_CTR" -CAkey "$PARENT_KEY" -CAcreateserial -out "$CA_CTR" -days $DAYS \
-extfile <(printf "keyUsage=critical,cRLSign,keyCertSign\nbasicConstraints=critical,CA:TRUE,pathlen:$PATH_LEN")) || exit_on_error "CA certificate signing"
Server and Client Certificates (They Share a Key)
openssl req -new -key "$KEY" -out "$CSR" -subj "$SUBJ" || exit_on_error "CSR generation for $TYPE"
openssl x509 -req -in "$CSR" -CA "$MID_CTR" -CAkey "$MID_KEY" -CAcreateserial -out "$CTR" -days $DAYS \
-extfile <(printf "keyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth$ALTNAME") || exit_on_error "Certificate signing for $TYPE"
Chain Structure
client/server -- mid -- gp -- root-ca
