# Whats well-known/est/cacerts

**URL:** <https://openziti.discourse.group/t/whats-well-known-est-cacerts/1842>\
**Category:** Ziti Overlay\
**Created:** [November 28, 2023, 6:59am UTC](https://openziti.discourse.group/t/whats-well-known-est-cacerts/1842 "2023-11-28T06:59:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anshPathak](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@anshPathak](https://openziti.discourse.group/u/anshPathak)\
**Post date:** [November 28, 2023, 6:59am UTC](https://openziti.discourse.group/t/whats-well-known-est-cacerts/1842/1 "2023-11-28T06:59:29Z")

</div>

Hi team,  
While exploring Ziti, I noticed that for every enrollment, the controller uses certificates from {CTRLURL}.well-known/est/cacerts.  
Could someone elaborate on what this contains?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [November 28, 2023, 11:05am UTC](https://openziti.discourse.group/t/whats-well-known-est-cacerts/1842/2 "2023-11-28T11:05:10Z")

</div>

That's not the way I'd describe it exactly. OpenZiti, by default, is configured to create identities. Those identities need to be signed by some signing authority. The controller configuration file contains a setting for this certificate authority. You can find this setting in the `edge.enrollment.signingCert` section...

> **[Controller Configuration Reference | OpenZiti](https://openziti.io/docs/reference/configuration/controller/)**
>
> OpenZiti uses configuration files for controllers that are in the YAML format.

After identities are created, to verify an identity the certificate chain will need to be verified. Clients, routers etc can pull the list of known CAs configured in the OpenZiti by accessing the URL you mention.

The cacerts endpoint is generally used during enrollment by the enrolling client to get the list of trusted CAs.

---

<div class="post-metadata">

**Author:** ![smilindave26](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/smilindave26/32/185_2.png) [@smilindave26](https://openziti.discourse.group/u/smilindave26)\
**Post date:** [November 28, 2023, 1:43pm UTC](https://openziti.discourse.group/t/whats-well-known-est-cacerts/1842/3 "2023-11-28T13:43:04Z")

</div>

> [@anshPathak](#):
>
> While exploring Ziti, I noticed that for every enrollment, the controller uses certificates from {CTRLURL}.well-known/est/cacerts.

You may find [RFC 7030](https://datatracker.ietf.org/doc/html/rfc7030) helpful, as this was a guide we used for secure enrollment.

This [5 Part Guide on Bootstrapping Trust](https://openziti.io/blog/bootstrapping-trust/part-01.encryption-everywhere/), especially [Part 5](https://openziti.io/blog/bootstrapping-trust/part-05.bootstrapping-trust) also provides excellent background details.