# Tls certification error

**URL:** <https://openziti.discourse.group/t/tls-certification-error/3307>\
**Category:** Uncategorized\
**Created:** [October 24, 2024, 7:10am UTC](https://openziti.discourse.group/t/tls-certification-error/3307 "2024-10-24T07:10:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vs\_01](https://avatars.discourse-cdn.com/v4/letter/v/3e96dc/32.png) [@vs\_01](https://openziti.discourse.group/u/vs_01)\
**Post date:** [October 24, 2024, 7:10am UTC](https://openziti.discourse.group/t/tls-certification-error/3307/1 "2024-10-24T07:10:12Z")

</div>

I am trying to setup an openziti network using [openziti\_manual\_pki/db at main · nenkoru/openziti\_manual\_pki · GitHub](https://github.com/nenkoru/openziti_manual_pki/tree/main/db).

 ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/d/d83fd5144fbbcda306624cb1771ed0254f568d15.png)  
This is the network topology I want. But getting certification error when try to add router2 in the network. It is getting connected to the controller but is not able to communicate to the public-edge-router.

I tried with openssl s\_client -connect :1280, i get reply as self-signed certificate in the certificate chain. 1280 is the port number where controller is hosted.

When i try openssl s\_client -connect :1290, i get reply as unable to get local issuer certificate. 1290 is the port number where public router is hosted.

How could this error be solved?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [October 24, 2024, 11:38am UTC](https://openziti.discourse.group/t/tls-certification-error/3307/2 "2024-10-24T11:38:21Z")

</div>

I recently forked that project and made changes. I'd recommend you use mine (unless my PR gets merged).

On my fork I've made this exact topology for you. Check out:

> **[GitHub - dovholuknf/openziti\_manual\_pki: Bootstrap PKI for OpenZiti manually](https://github.com/dovholuknf/openziti_manual_pki)**
>
> Bootstrap PKI for OpenZiti manually

Then in four separate windows run:

### window 1 - bootstrap the pki and then run the controller

```auto
./bootstrap.sh; ./run-controller.sh

```

### window 2 - run the public edge router

```auto
./run-edge-router.sh

```

### window 3 - run private router 1

```auto
./run-private-router-1.sh

```

### window 4 - run private router 2

```auto
./run-private-router-2.sh

```

### window 5 - run ziti cli commands:

```auto
$ ziti fabric list links
╭────────────────────────┬──────────────────┬──────────────────┬─────────────┬─────────────┬─────────────┬───────────┬────────┬───────────╮
│ ID │ DIALER │ ACCEPTOR │ STATIC COST │ SRC LATENCY │ DST LATENCY │ STATE │ STATUS │ FULL COST │
├────────────────────────┼──────────────────┼──────────────────┼─────────────┼─────────────┼─────────────┼───────────┼────────┼───────────┤
│ 1bBpxB339SS5oTWepHgOTL │ private-router-2 │ test-edge-router │ 1 │ 65000.0ms │ 65000.0ms │ Connected │ up │ 130001 │
│ 712wV4evrcqj17D6YO4ZnT │ private-router-1 │ test-edge-router │ 1 │ 65000.0ms │ 65000.0ms │ Connected │ up │ 130001 │
╰────────────────────────┴──────────────────┴──────────────────┴─────────────┴─────────────┴─────────────┴───────────┴────────┴───────────╯
results: 1-2 of 2
cd@192.168.253.239:sg4: ~/git/github/dovholuknf/openziti_manual_pki
$ ziti edge list ers
╭────────────┬──────────────────┬────────┬───────────────┬──────┬────────────╮
│ ID │ NAME │ ONLINE │ ALLOW TRANSIT │ COST │ ATTRIBUTES │
├────────────┼──────────────────┼────────┼───────────────┼──────┼────────────┤
│ CHRBtrh7yN │ test-edge-router │ true │ true │ 0 │ public │
│ IkqR-Nl7U │ private-router-2 │ true │ true │ 0 │ public │
│ yxuB-NlPUN │ private-router-1 │ true │ true │ 0 │ public │
╰────────────┴──────────────────┴────────┴───────────────┴──────┴────────────╯
results: 1-3 of 3

```