From a8f9ae28941f26009fc11c40c7e5e38e35ea05f2 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Tue, 7 Dec 2021 19:10:28 -0500 Subject: [PATCH 1/3] fix the ca file referenced --- quickstart/docker/image/ziti-cli-functions.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh index 516eb66b4..578122a45 100755 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -990,7 +990,7 @@ identity: cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-client.cert" server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem" key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_CONTROLLER_HOSTNAME}-server.key" - ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_INTERMEDIATE_NAME}.cert" + ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-cas.cert" ctrl: listener: tls:0.0.0.0:${ZITI_FAB_CTRL_PORT} From 8c0c8ecfb10584910ab01ed3aa9e9e7a3e844813 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Tue, 7 Dec 2021 19:16:17 -0500 Subject: [PATCH 2/3] use the proper chain file --- quickstart/docker/image/ziti-cli-functions.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh index 578122a45..c330dd66f 100755 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -990,7 +990,7 @@ identity: cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-client.cert" server_cert: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem" key: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/keys/${ZITI_CONTROLLER_HOSTNAME}-server.key" - ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_EDGE_ROUTER_RAWNAME}-cas.cert" + ca: "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem" ctrl: listener: tls:0.0.0.0:${ZITI_FAB_CTRL_PORT} From 666881b3cfdffb346af8e7aadf0e1ce179be6f02 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Tue, 7 Dec 2021 21:34:32 -0500 Subject: [PATCH 3/3] create a cas file using signing certs and server certs for controller --- quickstart/docker/image/ziti-cli-functions.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh index c330dd66f..dd7a1aef1 100755 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -974,6 +974,10 @@ function createControllerConfig { return 1 fi +cat "${ZITI_PKI_OS_SPECIFIC}/${ZITI_CONTROLLER_INTERMEDIATE_NAME}/certs/${ZITI_CONTROLLER_HOSTNAME}-server.chain.pem" > "${ZITI_PKI_OS_SPECIFIC}/cas.pem" +cat "${ZITI_PKI_OS_SPECIFIC}/${ZITI_SIGNING_INTERMEDIATE_NAME}/certs/${ZITI_SIGNING_INTERMEDIATE_NAME}.cert" >> "${ZITI_PKI_OS_SPECIFIC}/cas.pem" +echo "wrote CA file to: ${ZITI_PKI_OS_SPECIFIC}/cas.pem" + cat > "${ziti_home}/controller.yaml" <