Hi @elibrown333, welcome to the community and to OpenZiti (and zrok/BrowZer)!
A malformed token is strange. It makes me think the token was perhaps corrupt or just empty? We probably need more details. With the controller running, you're able to authenticate using the ziti CLI, right?
Have you inspected the token to make sure it's not corrupt? You're doing this all immediately too right, you didn't say pause in between making the controller and trying to enroll a router?
It's often helpful for us to see the full output of a command. Sometimes we can see abnormalities that aren't obvious if you don't look at these logs all the time...
Also if you can supply the full command you ran, and any relevant details, that's often useful too. One final thing, the controller has an "advertise" address, you're sure this new VM is able to connect to the controller, right? I would expect a totally different error, but if it can't connect, that might be why/how the .jwt ends up empty/malformed...
Those are some thoughts