diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh
index f4004d0ca..4d756f38d 100644
--- a/quickstart/docker/image/ziti-cli-functions.sh
+++ b/quickstart/docker/image/ziti-cli-functions.sh
@@ -740,9 +740,6 @@ function createPki {
   _pki_create_intermediate "${ZITI_PKI_SIGNER_ROOTCA_NAME}" "${ZITI_SPURIOUS_INTERMEDIATE}" 2
   _pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_PKI_SIGNER_INTERMEDIATE_NAME}" 1
 
-  echo "adding secondary intermediate into ca bundle"
-  cat "$ZITI_PKI/$ZITI_PKI_SIGNER_ROOTCA_NAME/certs/${ZITI_PKI_SIGNER_INTERMEDIATE_NAME}_spurious_intermediate.cert" >>"${ZITI_PKI_CTRL_CA}"
-
   echo " "
   pki_allow_list="localhost,${ZITI_NETWORK}"
   if [[ "${ZITI_CTRL_ADVERTISED_ADDRESS-}" != "" ]]; then
@@ -820,8 +817,15 @@ function createControllerConfig {
   file_path="${ZITI_HOME}"
   if [[ "${ZITI_HOME-}" == "" ]]; then file_path="."; fi
 
-  cat "${ZITI_PKI_CTRL_SERVER_CERT}" >"${ZITI_PKI_CTRL_CA}"
-  cat "${ZITI_PKI_SIGNER_CERT}" >>"${ZITI_PKI_CTRL_CA}"
+  echo "adding controller root CA to ca bundle: $ZITI_PKI/$ZITI_PKI_CTRL_ROOTCA_NAME/certs/$ZITI_PKI_CTRL_ROOTCA_NAME.cert"
+  cat "$ZITI_PKI/$ZITI_PKI_CTRL_ROOTCA_NAME/certs/$ZITI_PKI_CTRL_ROOTCA_NAME.cert" > "${ZITI_PKI_CTRL_CA}"
+
+  echo "adding signing root CA to ca bundle: $ZITI_PKI/$ZITI_PKI_SIGNER_ROOTCA_NAME/certs/$ZITI_PKI_SIGNER_ROOTCA_NAME.cert" >> "${ZITI_PKI_CTRL_CA}"
+  cat "$ZITI_PKI/$ZITI_PKI_SIGNER_ROOTCA_NAME/certs/$ZITI_PKI_SIGNER_ROOTCA_NAME.cert" >>"${ZITI_PKI_CTRL_CA}"
+
+  echo "adding secondary signing intermediate into ca bundle: $ZITI_PKI/$ZITI_PKI_SIGNER_ROOTCA_NAME/certs/${ZITI_PKI_SIGNER_INTERMEDIATE_NAME}_spurious_intermediate.cert"
+  cat "$ZITI_PKI/$ZITI_PKI_SIGNER_ROOTCA_NAME/certs/${ZITI_PKI_SIGNER_INTERMEDIATE_NAME}_spurious_intermediate.cert" >> "${ZITI_PKI_CTRL_CA}"
+
   echo -e "wrote CA file to: $(BLUE "${ZITI_PKI_CTRL_CA}")"
 
   output_file="${file_path}/${controller_name}.yaml"