I am trying to install openziti on AWS in production like environment. Which means I would like to have a controller and atleast 1 public router in one AWS account and most likely 2 edge routers in 2 different AWS accounts ( say one for client and one for server ). Q1: Does this sound like a good i…

Here’s the short steps you need to get that jwt… ### login somehow - I use zitiLogin zitiLogin ### use the output of ziti login to find your ziti-cli.json file and assign it ziti_cli_json="/home/ubuntu/.ziti/quickstart/ip-172-31-42-64/ziti-cli.json" ### strip the session from that file zt_sessio…

Awesome. Once I get the CA JWT can I enroll my user x509 cert as admin and use that for ziti login? ( our internal CA provides a service x509 cert and user x509 cert with minimal difference )

Yes? :smiley: I am pretty sure you can - but I have to admit that I’ve never done it using the ziti cli yet. It’s been on my todo list to figure out - but haven’t gotten to. I’ll putter around in ziti cli for a bit and see if I can figure it out. If you don’t hear back from me - I’ll get back to you…

I don’t see a particular setting to supply the certificate to the ziti edge login function. I’ll ask the rest of the team and see if there’s a way to accomplish it.I might just not know better.

Basic question - what is the difference between “ziti edge enroll” and “ziti edge create identity”? :slight_smile:

This is used to create an identity. When you do that, you can choose to emit a .jwt file (with -o), which is subsequently used in enrollment. As in: ziti edge create identity user name -a attributes -o output-file-name.jwt That .jwt can then be enrolled to produce an identity file: ziti edge enro…

But ziti edge enroll also creates the identity right? From what I understand it 2-in-1 op, create the identity and enroll.

No. The enroll command is entirely separate from the create command and will not function properly without creating an identity first.

gotcha. I was focusing on my use case where internal CA is registered for auto enrollment which works without explicit identity creation beforehand.

Noting 2 open questions here for easy reference - How to create a new user identity and use it with custom CA provided identity (x509 certificate) to run ziti cli commands? Is it possible to enroll routers using custom CA provided identity?

Openziti installation in production like environment

Support

TheLumberjack August 24, 2022, 8:11pm 40

@av-dev - i posted this question. Can you see if it's inline with what you're looking to do? I think I caught the spirit of your question but if not - toss a comment on it correcting me if you don't mind?

Topic		Replies	Views
General Architecture Questions General Questions	18	565	March 10, 2024
Questions from a newbie about my planned setup Uncategorized	19	457	October 28, 2024
Building simple network from scratch - Help Building/Development	15	1049	February 25, 2024
Ideas for Ziti TV? Uncategorized	59	2156	March 19, 2026
Securing a bunch of Machines General Questions	13	1256	June 21, 2022

Openziti installation in production like environment

Related topics