Thanks for taking a look. I was already aware of the ZITI_AUTO_RENEW_CERTS workaround and the manual certificate renewal process, but it would obviously be smarter if OpenZiti could continue to manage the certificates automatically.
Feel free to take a look at the script modification I wrote. It worked well for me, but it gets overwritten with every update 
Hi, just out of curiosity: Were you able to find a solution that can be integrated into the script?
Yes i believe so. I've left your post on my to-do list to follow up once we have a release because it will require one, so I can have you try it out. When the release is made I'll comment back here.
You'd basically add your management address (and any other names or IPs) to ZITI_CTRL_ADDITIONAL_SANS (a new variable that takes the comma-delimited list of DNS names / IPs), leave ZITI_AUTO_RENEW_CERTS on, and restart. From then on the bootstrap keeps those names in the cert on every start, so you won't have to maintain your own script going forward.
That's the plan. I don't have a release yet to have you test but I'll comment back when I do. Cheers
Thats sounds great. Can you in this step also implement a way to define Country, City, Org, etc. like in my modified script?
Thanks a lot