Use public CA server certificates for controller and router

Support General Questions
1

Hi,

we are deploying a self hosted ziti network to connect our platform with its extensions.
Extensions are web application (rest apis) exposed on the ziti network and we use zrok frontend to route call to the right extension (group of instances each of them binding to the same ziti service) based on the hostname.

We would like ziti client api and router to offer a certificate issued by a public ca (like let’s encrypt) while still using internal ziti CA for client authentication.
This is because there are corporate firewall like Fortigate, Checkpoint etc that have their own list of trusted CAs so they don’t allow connections if the server certificate is not signed by one of their ca.
According to the helm charts for deploying ziti, looks like it’s possible but I had issues with that:

Am I wrong in thinking that it can be done?
Thank you!

2

Mmmmm. OpenZIti really wants to manage its own PKI at this time. I believe this is the feature you would need Enable 3rd Party CA Router Enrollment · Issue #2110 · openziti/ziti · GitHub but I'm not 100% sure

I'll see if anyone else on the team has any additional thoughts until then, it'll be easier to get the root ca added to those troublesome firewalls?

3

I don’t understand why the certificate presented to clients must be signed by the same CA that signs identities. Trust a new CA in a big corporate firewall, it’s always a bureaucratic pain. Anyway, looking forward to the team feedback. Thank you!