# Stuck on error conecting to ziti edge management **URL:** \ **Category:** Uncategorized\ **Created:** [March 29, 2024, 7:01pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367 "2024-03-29T19:01:33Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![luisorozco](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@luisorozco](https://openziti.discourse.group/u/luisorozco)\ **Post date:** [March 29, 2024, 7:01pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/1 "2024-03-29T19:01:33Z")
Hi, im new in ziti i trying to create self-hosted zrok on a DO droplet on AlmaLinux 9 I follwed the instructions on quickstart guide for ziti [Host OpenZiti Anywhere | OpenZiti](https://openziti.io/docs/learn/quickstarts/network/hosted) it installed successfully, then, folling the guide for zrok self-hosted [Self-Hosting Guide for Linux | Zrok](https://docs.zrok.io/docs/guides/self-hosting/self_hosting_guide/) but when i run "zrok admin bootstrap /etc/ctrl.yml" i got this error [0.007] INFO zrok/controller/store.Open: database connected [0.190] INFO zrok/controller/store.(\*Store).migrate: applied 20 migrations [0.190] INFO zrok/controller.Bootstrap: connecting to the ziti edge management api panic: error connecting to the ziti edge management api: Get "[https://127.0.0.1:18080/.well-known/est/cacerts](https://127.0.0.1:18080/.well-known/est/cacerts)": dial tcp 127.0.0.1:18080: connect: connection refused goroutine 1 [running]: main.(\*adminBootstrap).run(0xc000761410, 0xc00073fbb0?, {0xc000761f00?, 0x0?, 0x0?}) /home/runner/work/zrok/zrok/cmd/zrok/adminBootstrap.go:40 +0xf7 [github.com/spf13/cobra.(\*Command).execute](http://github.com/spf13/cobra.(*Command).execute)(0xc0007aef08, {0xc000761ed0, 0x1, 0x1}) /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:987 +0xab1 [github.com/spf13/cobra.(\*Command).ExecuteC(0x4f4c500)](http://github.com/spf13/cobra.(*Command).ExecuteC(0x4f4c500)) /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1115 +0x3ff [github.com/spf13/cobra.(\*Command).Execute(...)](http://github.com/spf13/cobra.(*Command).Execute(...)) /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1039 main.main() /home/runner/work/zrok/zrok/cmd/zrok/main.go:106 +0x1a i'm not sure if it a zrok problem or if its a ziti problem, i think is a ziti problem because the error "panic: error connecting to the ziti edge management api: Get "[https://127.0.0.1:18080/.well-known/est/cacerts](https://127.0.0.1:18080/.well-known/est/cacerts)": dial tcp 127.0.0.1:18080: connect: connection refused" im stuk on this, can you help me? PD: SE linux and firewalld are disabled ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [March 29, 2024, 7:16pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/2 "2024-03-29T19:16:13Z")
Welcome, @luisorozco. I think your zrok controller config looks like this: ```yaml ziti: api_endpoint: "https://127.0.0.1:18080" ``` But `api_endpoint` needs to point to your ziti controller, not your zrok controller. The ziti controller has a management API address that is configured, and the zrok controller needs the same address to connect. You bootstrapped your ziti network with the `expressInstall()` quickstart, so the ziti `api_endpoint` in your zrok controller config must be like `https://${EXTERNAL_DNS}:${ZITI_CTRL_EDGE_ADVERTISED_PORT}`, substituting those two values from your environment, e.g., `https://ziti.example.com:8441`. After generating it with the quickstart, I assume you didn't customize the config. You can reference the generated config in the `$ZITI_HOME/$(hostname -s).yaml`, e.g., `~/.ziti/quickstart/computer1/computer1.yaml`. The ziti config value you are looking for in this file is the `address` property under the `web` section near the bottom. Here's an example snippet of a ziti controller config that shows the address `ziti.example.com:8441` in the same spot. ```yaml web: - name: client-management bindPoints: - interface: 0.0.0.0:8441 address: ziti.example.com:8441 identity: ca: "/home/kbingham/.ziti/quickstart/mira/pki/mira-edge-controller-root-ca/certs/mira-edge-controller-root-ca.cert" key: "/home/kbingham/.ziti/quickstart/mira/pki/mira-edge-controller-intermediate/keys/ziti.127.0.0.1.sslip.io-server.key" server_cert: "/home/kbingham/.ziti/quickstart/mira/pki/mira-edge-controller-intermediate/certs/ziti.127.0.0.1.sslip.io-server.chain.pem" cert: "/home/kbingham/.ziti/quickstart/mira/pki/mira-edge-controller-intermediate/certs/ziti.127.0.0.1.sslip.io-client.cert" options: idleTimeout: 5000ms writeTimeout: 100000ms minTLSVersion: TLS1.2 maxTLSVersion: TLS1.3 apis: - binding: edge-management options: { } - binding: edge-oidc options: { } - binding: edge-client options: { } - binding: fabric options: { } ``` ---
**Author:** ![luisorozco](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@luisorozco](https://openziti.discourse.group/u/luisorozco)\ **Post date:** [March 31, 2024, 9:39am UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/3 "2024-03-31T09:39:17Z")
Hi, thank you for your answer. It works perfect! I completed the self-host guide for zrok and it is running now. but now im stuck when im trying to setup nrok on the local machine, i set the apiEndpoint of zrok to my ziti/ngrok DO droplet. but when i run zrok status i got Environment: PROPERTY VALUE Secret Token \<\> Ziti Identity \<\> i dont know exactly what to do with that. Then i ran zrok enable (my environment) and works! but when i run i got [0.973] ERROR main.(\*sharePublicCommand).run.func3: error running http web backend: loading new config: http app module: start: listening on zrok/aqrpdtquanot:0: failed to listen: no apiSession, authentication attempt failed: Get "[https://controller.domain.example.com:8441/oidc/authorize?client\_id=native&code\_challenge=Es2KR1aps6gl9CI33Za-vUJBwi-│uxBe2zZgTZzff6Sg&code\_challenge\_method=S256&method=cert&prompt=Welcome+back!&redirect\_uri=http%3A%2F%2F127.0.0.1%3A34797%2Fauth%2Fcallback&response\_type=code&scope=openid+offline\_access&state=27516d6f-a2ca-4c89-ae4a-054b216c69d0](https://controller.domain.example.com:8441/oidc/authorize?client_id=native&code_challenge=Es2KR1aps6gl9CI33Za-vUJBwi-%E2%94%82uxBe2zZgTZzff6Sg&code_challenge_method=S256&method=cert&prompt=Welcome+back%21&redirect_uri=http%3A%2F%2F127.0.0.1%3A34797%2Fauth%2Fcallback&response_type=code&scope=openid+offline_access&state=27516d6f-a2ca-4c89-ae4a-054b216c69d0)": redirect is not allowed as per DomainCheckRedirectPolicy im stuck again. Sorry, im new with zrok. ---
**Author:** ![rohit](https://avatars.discourse-cdn.com/v4/letter/r/41988e/32.png) [@rohit](https://openziti.discourse.group/u/rohit)\ **Post date:** [April 2, 2024, 5:49pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/4 "2024-04-02T17:49:27Z")
Hey @luisorozco any update on the recent issue you faced related to the DomainCheckRedirectPolicy? I am stuck on the same error ☹ ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [April 3, 2024, 12:58pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/5 "2024-04-03T12:58:33Z")
I think you were successful enabling your zrok environment with your self-hosted zrok instance. Congrats on that. 🙂 Next, you wish to configure your zrok frontend for OAuth with Google or GitHub login? After you configure OAuth, then you'll be able to use it with any zrok public shares. There are two steps to set up OAuth for your zrok frontend: 1. In the identity provider ([link to GitHub developer settings](https://github.com/settings/developers#oauth-apps)) ([link to Google developer doc](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid)), create a client id/secret for your zrok frontend 2. In the zrok frontend config.yml file, set the client id/secret for each OAuth provider you wish to use ([link to self-hosted zrok OAuth doc](https://docs.zrok.io/docs/guides/self-hosting/oauth/configuring-oauth/)) After your zrok frontend is configured for your chosen OAuth provider (Google or GitHub or both), then it will work. ---
**Author:** ![luisorozco](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@luisorozco](https://openziti.discourse.group/u/luisorozco)\ **Post date:** [April 4, 2024, 3:55am UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/6 "2024-04-04T03:55:45Z")
@rohit not yet ☹ @qrkourier thank you, but for this envoriment i'm will no enable a OAuth. Im no sure if this "DomainCheckRedirectPolicy error" is related to OAuth. ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [April 4, 2024, 1:08pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/7 "2024-04-04T13:08:31Z")
I may have lept to the wrong conclusion when I saw the OIDC part of the URL path that you shared. 🙂 I thought you were attempting OAuth with a zrok public share. I see this is an error message emitted by the `zrok share public` command (or `zrok share reserved` for a public share), correct? Let's ensure there are no OAuth configurations in effect because you're not using OAuth. In the zrok frontend's config.yml file, ensure there is not an `oauth` section. Here's an example config file: [zrok/etc/frontend.yml at main · openziti/zrok · GitHub](https://github.com/openziti/zrok/blob/main/etc/frontend.yml). I'll ask around to see why else zrok might emit this particular ERROR. EDIT: follow-on question - were you attempting to log in with OIDC (one type of SSO) through the zrok share URL at the time of the error, e.g., in your web browser? ---
**Author:** ![rohit](https://avatars.discourse-cdn.com/v4/letter/r/41988e/32.png) [@rohit](https://openziti.discourse.group/u/rohit)\ **Post date:** [April 4, 2024, 1:56pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/8 "2024-04-04T13:56:01Z")
Sure @qrkourier, will try that and let you know. Off topic, I've read that we can enable multiple environments in one zrok instance, any idea how? ---
**Author:** ![rohit](https://avatars.discourse-cdn.com/v4/letter/r/41988e/32.png) [@rohit](https://openziti.discourse.group/u/rohit)\ **Post date:** [April 4, 2024, 2:02pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/9 "2024-04-04T14:02:54Z")
@qrkourier regarding front.yml, I've made sure I am not using any OAuth config: ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/8/83803b8a8ea6c1d31ae5019c7e097e1a35d71729.png)Neither am I trying to use SSO while running zrok share public ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [April 4, 2024, 2:07pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/10 "2024-04-04T14:07:50Z")
> [@rohit](#): > > I've read that we can enable multiple environments in one zrok instance, any idea how? Let's make sure we're using the same words. Your zrok instance is the stack of zrok controllers and frontends that handle requests from all of your zrok environments. You enable a zrok ~~enable~~ _environment_ on all the devices that will share or access a share. ---
**Author:** ![luisorozco](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@luisorozco](https://openziti.discourse.group/u/luisorozco)\ **Post date:** [April 7, 2024, 11:08pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/11 "2024-04-07T23:08:56Z")
thank for your response. this is my frontend.yml v: 3 host\_match: cloud.betics.com.mx address: 0.0.0.0:8080 tls: cert\_path: "/etc/letsencrypt/live/ziti.mydomain.com/cert.pem" key\_path: "/etc/letsencrypt/live/ziti.mydomain.com/privkey.pem" thouse pem file were generated by certbot --manual and got the same error error creating proxy backend (error listening: failed to listen: no apiSession, authentication attempt failed: .... redirect is not allowed as per DomainCheckRedirectPolicy ---
**Author:** ![luisorozco](https://avatars.discourse-cdn.com/v4/letter/l/3ab097/32.png) [@luisorozco](https://openziti.discourse.group/u/luisorozco)\ **Post date:** [April 10, 2024, 6:49am UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/12 "2024-04-10T06:49:56Z")
I think the error: │[0.756] ERROR main.(\*shareReservedCommand).run.func2: error running http web backend: loading new config: http app module: start: listening on zrok/dioeujv52ghg:0: failed to listen: no apiSession, authentication attempt failed: Get "[https://api](https://api).{myhost}:8441/oidc/authorize?client\_id=native&code\_challenge=ZfpwdI5mJqOUwvUOQ\_ES3yDFWr7sxzfOuljPXRukXT0&code\_challenge\_method=S256&method=cert&prompt=Welcome+back%21&redirect\_uri=http%3A%2F%2F127.0.0.1%3A33349%2Fauth%2Fcallback&response\_type=code&scope=openid+offline\_access&state=66cbb15b-2a55-4fdf-a259-e331eac79c96": redirect is not allowed as per DomainCheckRedirectPolicy is a SSL cert problem, i dont know and not sure but if you access to URL containted in the error on the browser got a "Invalid Cert", that it is issued by NetFoundry, my theory is that when the request is sent to the enpoint and got the response as "invalid cert" redirect to http version of the URL. is that posible? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 10, 2024, 12:09pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/13 "2024-04-10T12:09:26Z")
4 posts were split to a new topic: [Problem with zrok share public](https://openziti.discourse.group/t/problem-with-zrok-share-public/2416) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 10, 2024, 1:15pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/14 "2024-04-10T13:15:26Z")
Hi @luisorozco. I think this is an issue a bug with versions 0.4.22+. Can you download and try version 4.20? [Release v0.4.20 · openziti/zrok · GitHub](https://github.com/openziti/zrok/releases/tag/v0.4.20) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [April 10, 2024, 2:18pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/15 "2024-04-10T14:18:22Z")
Recent versions of ziti added an endpoint that's causing this issue. The fix for the ziti environment is merged. You have a few options, ranked in the order that I think makes most sense: 1. open the controller yaml file (probably at `$HOME/.ziti/quickstart/$(hostname)/$(hostname).yaml`), go to the bottom of the file, remove or comment out these lines and use zrok 0.4.26 without a problem: 2. use zrok 0.4.20 for now 3. wait for a new `ziti` release and use that release 4. use an older version of ziti (this is harder to do and i'd recommend you just do one of the above) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [July 17, 2025, 1:00pm UTC](https://openziti.discourse.group/t/stuck-on-error-conecting-to-ziti-edge-management/2367/16 "2025-07-17T13:00:36Z")
A post was split to a new topic: [Linux controller keeps restarting](https://openziti.discourse.group/t/linux-controller-keeps-restarting/4880)