diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh
index b5b1b8366..aca1ad73d 100755
--- a/quickstart/docker/image/ziti-cli-functions.sh
+++ b/quickstart/docker/image/ziti-cli-functions.sh
@@ -56,7 +56,7 @@ function cleanZitiController {
 }
 function initializeController {
   log_file="${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}-init.log"
-"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}"
+  "${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}"
   echo -e "ziti-controller initialized. see $(BLUE "${log_file}") for details"
 }
 function startZitiController {
@@ -611,33 +611,34 @@ function expressInstall {
 }
 
 function pki_client_server {
-  name_local=${1-}
-  ZITI_CA_NAME_local=$2
-  ip_local=$3
+  file_name=${1-}
+  allow_list=$2
+  ZITI_CA_NAME_local=$3
+  ip_local=$4
 
   if [[ "${ip_local}" == "" ]]; then
     ip_local="127.0.0.1"
   fi
 
-  if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then
-    echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
+  if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-server.key"; then
+    echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
     "${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
-          --server-file "${name_local}-server" \
-          --dns "${name_local},localhost" --ip "${ip_local}" \
-          --server-name "${name_local} server certificate"
+          --server-file "${file_name}-server" \
+          --dns "${allow_list}" --ip "${ip_local}" \
+          --server-name "${file_name} server certificate"
   else
-    echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
+    echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
     echo "key exists"
   fi
 
-  if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then
-    echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
+  if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-client.key"; then
+    echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
     "${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \
-          --client-file "${name_local}-client" \
-          --key-file "${name_local}-server" \
-          --client-name "${name_local}"
+          --client-file "${file_name}-client" \
+          --key-file "${file_name}-server" \
+          --client-name "${file_name}"
   else
-    echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}"
+    echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}"
     echo "key exists"
   fi
   echo " "
@@ -717,7 +718,7 @@ function createRouterPki {
   export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert"
   export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key"
   export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert"
-  pki_client_server "${router_name}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
+  pki_client_server "${router_name}" "${router_name},localhost,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}"
 }
 
 function createPrivateRouterConfig {
@@ -773,8 +774,10 @@ function createPki {
   pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1
 
   echo " "
-  pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}"
-  pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}"
+  pki_allow_list="${ZITI_CONTROLLER_HOSTNAME},localhost"
+  if [[ "$EXTERNAL_DNS" != "" ]]; then pki_allow_list="$pki_allow_list,$EXTERNAL_DNS"; fi
+  pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${pki_allow_list}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}"
+  pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}"
 }