# Router enrollment fails with "token signature is invalid" - JWT kid vs EST cacerts mismatch **URL:** \ **Category:** Ziti Overlay\ **Created:** [December 2, 2025, 8:29pm UTC](https://openziti.discourse.group/t/router-enrollment-fails-with-token-signature-is-invalid-jwt-kid-vs-est-cacerts-mismatch/5394 "2025-12-02T20:29:03Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [December 2, 2025, 8:47pm UTC](https://openziti.discourse.group/t/router-enrollment-fails-with-token-signature-is-invalid-jwt-kid-vs-est-cacerts-mismatch/5394/2 "2025-12-02T20:47:31Z")
Hi @jfin, welcome to the community and to OpenZiti > [@jfin](#): > > **Deployment** : Custom PKI on bare EC2 (not K8s, not quickstart) Not gonna lie - this line does scare me as someone trying to support the community. Getting the PKI right is a difficult thing to do and not for the faint of heart. I expect you've misconfigured it somehow. Also this statement at the end of your post is incorrect. `*Quickstart works because it uses internal enrollment that bypasses external JWT verification.*`. That is not true, don't be misled... I'd suggest you read through this older thread [OpenZiti network from scratch - #10 by nenkoru](https://openziti.discourse.group/t/openziti-network-from-scratch/2168/10) and possibly watch the Ziti TV if you need to. Community member @nenkoru put up [GitHub - nenkoru/openziti\_manual\_pki: Bootstrap PKI for OpenZiti manually](https://github.com/nenkoru/openziti_manual_pki/tree/main) which is referenced in that thread. I think that's really waht you need. If you follow that and still have questions, I think we can go from there? --- _[View the full topic](https://openziti.discourse.group/t/router-enrollment-fails-with-token-signature-is-invalid-jwt-kid-vs-est-cacerts-mismatch/5394)._