diff --git a/ziti/cmd/art.go b/ziti/cmd/art.go
index 25caa7fb0..9d12311e9 100644
--- a/ziti/cmd/art.go
+++ b/ziti/cmd/art.go
@@ -17,6 +17,7 @@
 package cmd
 
 import (
+	"github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/internal/log"
 	"io"
@@ -27,12 +28,12 @@ import (
 const ()
 
 type ArtOptions struct {
-	CommonOptions
+	common.CommonOptions
 }
 
 func NewCmdArt(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &ArtOptions{
-		CommonOptions: CommonOptions{
+		CommonOptions: common.CommonOptions{
 			Out: out,
 			Err: errOut,
 		},
diff --git a/ziti/cmd/cmd.go b/ziti/cmd/cmd.go
index 58e8a752b..996f56ff7 100644
--- a/ziti/cmd/cmd.go
+++ b/ziti/cmd/cmd.go
@@ -21,11 +21,13 @@ import (
 	"fmt"
 	"github.com/openziti/ziti/ziti/cmd/agentcli"
 	"github.com/openziti/ziti/ziti/cmd/common"
+	"github.com/openziti/ziti/ziti/cmd/create"
 	"github.com/openziti/ziti/ziti/cmd/database"
 	"github.com/openziti/ziti/ziti/cmd/demo"
 	"github.com/openziti/ziti/ziti/cmd/edge"
 	"github.com/openziti/ziti/ziti/cmd/fabric"
 	"github.com/openziti/ziti/ziti/cmd/install"
+	"github.com/openziti/ziti/ziti/cmd/pki"
 	"github.com/openziti/ziti/ziti/cmd/templates"
 	c "github.com/openziti/ziti/ziti/constants"
 	"github.com/openziti/ziti/ziti/controller"
@@ -45,7 +47,7 @@ import (
 
 // InitOptions the flags for running init
 type MainOptions struct {
-	CommonOptions
+	common.CommonOptions
 }
 
 type RootCmd struct {
@@ -121,12 +123,12 @@ func NewCmdRoot(in io.Reader, out, err io.Writer, cmd *cobra.Command) *cobra.Com
 
 	p := common.NewOptionsProvider(out, err)
 
-	createCommands := NewCmdCreate(out, err)
+	createCommands := create.NewCmdCreate(out, err)
 	controllerCmd := controller.NewControllerCmd()
 	tunnelCmd := tunnel.NewTunnelCmd(false)
 	routerCmd := router.NewRouterCmd()
 	agentCommands := agentcli.NewAgentCmd(p)
-	pkiCommands := NewCmdPKI(out, err)
+	pkiCommands := pki.NewCmdPKI(out, err)
 	fabricCommand := fabric.NewFabricCmd(p)
 	edgeCommand := edge.NewCmdEdge(out, err)
 	demoCmd := demo.NewDemoCmd(p)
diff --git a/ziti/cmd/common.go b/ziti/cmd/common.go
deleted file mode 100644
index 2deb44796..000000000
--- a/ziti/cmd/common.go
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
-	Copyright NetFoundry Inc.
-
-	Licensed under the Apache License, Version 2.0 (the "License");
-	you may not use this file except in compliance with the License.
-	You may obtain a copy of the License at
-
-	https://www.apache.org/licenses/LICENSE-2.0
-
-	Unless required by applicable law or agreed to in writing, software
-	distributed under the License is distributed on an "AS IS" BASIS,
-	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-	See the License for the specific language governing permissions and
-	limitations under the License.
-*/
-
-package cmd
-
-import (
-	"github.com/spf13/cobra"
-	"io"
-)
-
-// CommonOptions contains common options and helper methods
-type CommonOptions struct {
-	Out            io.Writer
-	Err            io.Writer
-	Cmd            *cobra.Command
-	Args           []string
-	BatchMode      bool
-	Verbose        bool
-	Staging        bool
-	ConfigIdentity string
-	Timeout        int
-}
-
-func (options *CommonOptions) AddCommonFlags(cmd *cobra.Command) {
-	cmd.Flags().BoolVarP(&options.BatchMode, "batch-mode", "b", false, "In batch mode the command never prompts for user input")
-	cmd.Flags().BoolVarP(&options.Verbose, "verbose", "", false, "Enable verbose logging")
-	cmd.Flags().BoolVarP(&options.Staging, "staging", "", false, "Install/Upgrade components from the ziti-staging repo")
-	cmd.Flags().StringVarP(&options.ConfigIdentity, "configIdentity", "i", "", "Which configIdentity to use")
-	cmd.Flags().IntVarP(&options.Timeout, "timeout", "t", 5, "Timeout for REST operations (specified in seconds)")
-	options.Cmd = cmd
-}
-
-func (options *CommonOptions) panicOnErr(err error) {
-	if err != nil {
-		panic(err)
-	}
-}
diff --git a/ziti/cmd/config_templates/controller.yml b/ziti/cmd/create/config_templates/controller.yml
similarity index 100%
rename from ziti/cmd/config_templates/controller.yml
rename to ziti/cmd/create/config_templates/controller.yml
diff --git a/ziti/cmd/config_templates/environment.yml b/ziti/cmd/create/config_templates/environment.yml
similarity index 100%
rename from ziti/cmd/config_templates/environment.yml
rename to ziti/cmd/create/config_templates/environment.yml
diff --git a/ziti/cmd/config_templates/router.yml b/ziti/cmd/create/config_templates/router.yml
similarity index 100%
rename from ziti/cmd/config_templates/router.yml
rename to ziti/cmd/create/config_templates/router.yml
diff --git a/ziti/cmd/create.go b/ziti/cmd/create/create.go
similarity index 77%
rename from ziti/cmd/create.go
rename to ziti/cmd/create/create.go
index 3fde148bd..a4341c963 100644
--- a/ziti/cmd/create.go
+++ b/ziti/cmd/create/create.go
@@ -14,10 +14,11 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
+	"github.com/openziti/ziti/ziti/cmd/pki"
 	"github.com/openziti/ziti/ziti/cmd/templates"
 	"github.com/spf13/cobra"
 	"io"
@@ -43,11 +44,11 @@ func NewCmdCreate(out io.Writer, errOut io.Writer) *cobra.Command {
 
 	cmd.AddCommand(NewCmdCreateConfig())
 
-	cmd.AddCommand(NewCmdPKICreateCA(out, errOut))
-	cmd.AddCommand(NewCmdPKICreateIntermediate(out, errOut))
-	cmd.AddCommand(NewCmdPKICreateServer(out, errOut))
-	cmd.AddCommand(NewCmdPKICreateClient(out, errOut))
-	cmd.AddCommand(NewCmdPKICreateCSR(out, errOut))
+	cmd.AddCommand(pki.NewCmdPKICreateCA(out, errOut))
+	cmd.AddCommand(pki.NewCmdPKICreateIntermediate(out, errOut))
+	cmd.AddCommand(pki.NewCmdPKICreateServer(out, errOut))
+	cmd.AddCommand(pki.NewCmdPKICreateClient(out, errOut))
+	cmd.AddCommand(pki.NewCmdPKICreateCSR(out, errOut))
 
 	return cmd
 }
diff --git a/ziti/cmd/create_config.go b/ziti/cmd/create/create_config.go
similarity index 97%
rename from ziti/cmd/create_config.go
rename to ziti/cmd/create/create_config.go
index 02077bc8b..6a859cb6d 100644
--- a/ziti/cmd/create_config.go
+++ b/ziti/cmd/create/create_config.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	"github.com/openziti/ziti/ziti/cmd/common"
@@ -196,12 +196,6 @@ type RouterListenerTemplateValues struct {
 	OutQueueSize      int
 }
 
-var workingDir string
-
-func init() {
-	workingDir, _ = cmdHelper.GetZitiHome()
-}
-
 // NewCmdCreateConfig creates a command object for the "config" command
 func NewCmdCreateConfig() *cobra.Command {
 	cmd := &cobra.Command{
@@ -227,14 +221,13 @@ func (options *CreateConfigOptions) addCreateFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().StringVarP(&options.Output, optionOutput, "o", defaultOutput, outputDescription)
 }
 
-func (data *ConfigTemplateValues) populateConfigValues() {
+func (data *ConfigTemplateValues) PopulateConfigValues() {
 
 	// Get and add hostname to the params
 	data.Hostname = cmdHelper.HostnameOrNetworkName()
 
 	// Get and add ziti home to the params
-	zitiHome, err := cmdHelper.GetZitiHome()
-	handleVariableError(err, constants.ZitiHomeVarName)
+	zitiHome := cmdHelper.GetZitiHome()
 
 	data.ZitiHome = zitiHome
 	// ************* Controller Values ************
diff --git a/ziti/cmd/create_config_controller.go b/ziti/cmd/create/create_config_controller.go
similarity index 93%
rename from ziti/cmd/create_config_controller.go
rename to ziti/cmd/create/create_config_controller.go
index e60dac746..ce68d14ed 100644
--- a/ziti/cmd/create_config_controller.go
+++ b/ziti/cmd/create/create_config_controller.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	_ "embed"
@@ -107,7 +107,7 @@ func NewCmdCreateConfigController() *CreateControllerConfigCmd {
 					logrus.SetOutput(logOut)
 				}
 
-				data.populateConfigValues()
+				data.PopulateConfigValues()
 
 				// Update controller specific values with configOptions passed in if the argument was provided or the value is currently blank
 				if data.Controller.Ctrl.AdvertisedPort == "" || controllerOptions.CtrlPort != constants.DefaultCtrlAdvertisedPort {
@@ -196,28 +196,28 @@ func SetControllerIdentity(data *ControllerTemplateValues) {
 func SetControllerIdentityCert(c *ControllerTemplateValues) {
 	val := os.Getenv(constants.PkiCtrlCertVarName)
 	if val == "" {
-		val = workingDir + "/" + helpers2.HostnameOrNetworkName() + ".cert" // default
+		val = helpers2.GetZitiHome() + "/" + helpers2.HostnameOrNetworkName() + ".cert" // default
 	}
 	c.Identity.Cert = helpers2.NormalizePath(val)
 }
 func SetControllerIdentityServerCert(c *ControllerTemplateValues) {
 	val := os.Getenv(constants.PkiCtrlServerCertVarName)
 	if val == "" {
-		val = workingDir + "/" + helpers2.HostnameOrNetworkName() + ".server.chain.cert" // default
+		val = helpers2.GetZitiHome() + "/" + helpers2.HostnameOrNetworkName() + ".server.chain.cert" // default
 	}
 	c.Identity.ServerCert = helpers2.NormalizePath(val)
 }
 func SetControllerIdentityKey(c *ControllerTemplateValues) {
 	val := os.Getenv(constants.PkiCtrlKeyVarName)
 	if val == "" {
-		val = workingDir + "/" + helpers2.HostnameOrNetworkName() + ".key" // default
+		val = helpers2.GetZitiHome() + "/" + helpers2.HostnameOrNetworkName() + ".key" // default
 	}
 	c.Identity.Key = helpers2.NormalizePath(val)
 }
 func SetControllerIdentityCA(c *ControllerTemplateValues) {
 	val := os.Getenv(constants.PkiCtrlCAVarName)
 	if val == "" {
-		val = workingDir + "/" + helpers2.HostnameOrNetworkName() + ".ca" // default
+		val = helpers2.GetZitiHome() + "/" + helpers2.HostnameOrNetworkName() + ".ca" // default
 	}
 	c.Identity.Ca = helpers2.NormalizePath(val)
 }
@@ -229,7 +229,7 @@ func SetEdgeConfig(data *ControllerTemplateValues) {
 func SetEdgeSigningCert(c *ControllerTemplateValues) {
 	val := os.Getenv(constants.PkiSignerCertVarName)
 	if val == "" {
-		val = workingDir + "/" + helpers2.HostnameOrNetworkName() + ".signing.cert" // default
+		val = helpers2.GetZitiHome() + "/" + helpers2.HostnameOrNetworkName() + ".signing.cert" // default
 	}
 	c.EdgeEnrollment.SigningCert = helpers2.NormalizePath(val)
 
@@ -237,7 +237,7 @@ func SetEdgeSigningCert(c *ControllerTemplateValues) {
 func SetEdgeSigningKey(c *ControllerTemplateValues) {
 	val := os.Getenv(constants.PkiSignerKeyVarName)
 	if val == "" {
-		val = workingDir + "/" + helpers2.HostnameOrNetworkName() + ".signing.key" // default
+		val = helpers2.GetZitiHome() + "/" + helpers2.HostnameOrNetworkName() + ".signing.key" // default
 	}
 	c.EdgeEnrollment.SigningCertKey = helpers2.NormalizePath(val)
 }
diff --git a/ziti/cmd/create_config_controller_test.go b/ziti/cmd/create/create_config_controller_test.go
similarity index 95%
rename from ziti/cmd/create_config_controller_test.go
rename to ziti/cmd/create/create_config_controller_test.go
index 51a273628..5f319f4ad 100644
--- a/ziti/cmd/create_config_controller_test.go
+++ b/ziti/cmd/create/create_config_controller_test.go
@@ -1,4 +1,4 @@
-package cmd
+package create
 
 import (
 	"fmt"
@@ -250,25 +250,25 @@ func TestCtrlConfigDefaultsWhenUnset(t *testing.T) {
 
 	// identity:
 	t.Run("TestPKICert", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".cert"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".cert"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.Cert)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.Cert)
 	})
 	t.Run("TestPKIServerCert", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".server.chain.cert"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".server.chain.cert"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.ServerCert)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.ServerCert)
 	})
 	t.Run("TestPKIKey", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".key"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".key"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.Key)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.Key)
 	})
 	t.Run("TestPKICA", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".ca"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".ca"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.Ca)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.Ca)
@@ -325,14 +325,14 @@ func TestCtrlConfigDefaultsWhenUnset(t *testing.T) {
 	})
 	t.Run("TestEdgeEnrollmentSigningCert", func(t *testing.T) {
 		// Should default to the value of Ctrl Edge Advertised Port
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.cert"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.cert"
 
 		assert.Equal(t, expectedValue, data.Controller.EdgeEnrollment.SigningCert)
 		assert.Equal(t, expectedValue, ctrlConfig.Edge.Enrollment.SigningCert.Cert)
 	})
 	t.Run("TestEdgeEnrollmentSigningKey", func(t *testing.T) {
 		// Should default to the value of Ctrl Edge Advertised Port
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.key"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.key"
 
 		assert.Equal(t, expectedValue, data.Controller.EdgeEnrollment.SigningCertKey)
 		assert.Equal(t, expectedValue, ctrlConfig.Edge.Enrollment.SigningCert.Key)
@@ -450,25 +450,25 @@ func TestCtrlConfigDefaultsWhenBlank(t *testing.T) {
 
 	// identity:
 	t.Run("TestPKICert", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".cert"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".cert"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.Cert)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.Cert)
 	})
 	t.Run("TestPKIServerCert", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".server.chain.cert"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".server.chain.cert"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.ServerCert)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.ServerCert)
 	})
 	t.Run("TestPKIKey", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".key"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".key"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.Key)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.Key)
 	})
 	t.Run("TestPKICA", func(t *testing.T) {
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".ca"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".ca"
 
 		assert.Equal(t, expectedValue, data.Controller.Identity.Ca)
 		assert.Equal(t, expectedValue, ctrlConfig.Identity.Ca)
@@ -525,14 +525,14 @@ func TestCtrlConfigDefaultsWhenBlank(t *testing.T) {
 	})
 	t.Run("TestEdgeEnrollmentSigningCert", func(t *testing.T) {
 		// Should default to the value of Ctrl Edge Advertised Port
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.cert"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.cert"
 
 		assert.Equal(t, expectedValue, data.Controller.EdgeEnrollment.SigningCert)
 		assert.Equal(t, expectedValue, ctrlConfig.Edge.Enrollment.SigningCert.Cert)
 	})
 	t.Run("TestEdgeEnrollmentSigningKey", func(t *testing.T) {
 		// Should default to the value of Ctrl Edge Advertised Port
-		expectedValue := workingDir + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.key"
+		expectedValue := cmdhelper.GetZitiHome() + "/" + cmdhelper.HostnameOrNetworkName() + ".signing.key"
 
 		assert.Equal(t, expectedValue, data.Controller.EdgeEnrollment.SigningCertKey)
 		assert.Equal(t, expectedValue, ctrlConfig.Edge.Enrollment.SigningCert.Key)
@@ -663,6 +663,23 @@ func TestZitiCtrlIdentitySection(t *testing.T) {
 	assert.Equal(t, caPath, ctrlConfig.Identity.Ca)
 }
 
+func TestDefaultPkiPath(t *testing.T) {
+	expectedPkiRoot := "/tmp/expectedPkiRoot"
+	keys := map[string]string{
+		"ZITI_HOME": expectedPkiRoot,
+	}
+
+	ctrlConfig, data := execCreateConfigControllerCommand(nil, keys)
+
+	assert.Contains(t, data.Controller.Identity.Cert, expectedPkiRoot)
+	assert.Contains(t, data.Controller.Identity.ServerCert, expectedPkiRoot)
+	assert.Contains(t, ctrlConfig.Identity.ServerCert, expectedPkiRoot)
+	assert.Contains(t, data.Controller.Identity.Key, expectedPkiRoot)
+	assert.Contains(t, ctrlConfig.Identity.Key, expectedPkiRoot)
+	assert.Contains(t, data.Controller.Identity.Ca, expectedPkiRoot)
+	assert.Contains(t, ctrlConfig.Identity.Ca, expectedPkiRoot)
+}
+
 func TestCtrlBindAddress(t *testing.T) {
 	customValue := "123.456.7.8"
 	keys := map[string]string{
diff --git a/ziti/cmd/create_config_environment.go b/ziti/cmd/create/create_config_environment.go
similarity index 99%
rename from ziti/cmd/create_config_environment.go
rename to ziti/cmd/create/create_config_environment.go
index 24daba587..fb5066152 100644
--- a/ziti/cmd/create_config_environment.go
+++ b/ziti/cmd/create/create_config_environment.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	_ "embed"
@@ -83,7 +83,7 @@ func NewCmdCreateConfigEnvironment() *cobra.Command {
 		Long:    createConfigEnvironmentLong,
 		Example: createConfigEnvironmentExample,
 		PreRun: func(cmd *cobra.Command, args []string) {
-			data.populateConfigValues()
+			data.PopulateConfigValues()
 			// Set router identities
 			SetZitiRouterIdentity(&data.Router, validateRouterName(""))
 			// Set up other identity info
diff --git a/ziti/cmd/create_config_router.go b/ziti/cmd/create/create_config_router.go
similarity index 98%
rename from ziti/cmd/create_config_router.go
rename to ziti/cmd/create/create_config_router.go
index 0585827e1..6b7948aa6 100644
--- a/ziti/cmd/create_config_router.go
+++ b/ziti/cmd/create/create_config_router.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	_ "embed"
@@ -70,7 +70,7 @@ func NewCmdCreateConfigRouter(routerOptions *CreateConfigRouterOptions) *NewCrea
 					logrus.SetOutput(logOut)
 				}
 
-				data.populateConfigValues()
+				data.PopulateConfigValues()
 
 				// Update router data with options passed in
 				data.Router.Name = validateRouterName(routerOptions.RouterName)
diff --git a/ziti/cmd/create_config_router_common.go b/ziti/cmd/create/create_config_router_common.go
similarity index 87%
rename from ziti/cmd/create_config_router_common.go
rename to ziti/cmd/create/create_config_router_common.go
index 78f49baee..b0429eb9f 100644
--- a/ziti/cmd/create_config_router_common.go
+++ b/ziti/cmd/create/create_config_router_common.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	_ "embed"
@@ -58,28 +58,28 @@ func SetZitiRouterIdentity(r *RouterTemplateValues, routerName string) {
 func SetZitiRouterIdentityCert(r *RouterTemplateValues, routerName string) {
 	val := os.Getenv(constants.ZitiRouterIdentityCertVarName)
 	if val == "" {
-		val = workingDir + "/" + routerName + ".cert" // default
+		val = helpers2.GetZitiHome() + "/" + routerName + ".cert" // default
 	}
 	r.IdentityCert = cmdhelper.NormalizePath(val)
 }
 func SetZitiRouterIdentityServerCert(r *RouterTemplateValues, routerName string) {
 	val := os.Getenv(constants.ZitiRouterIdentityServerCertVarName)
 	if val == "" {
-		val = workingDir + "/" + routerName + ".server.chain.cert" // default
+		val = helpers2.GetZitiHome() + "/" + routerName + ".server.chain.cert" // default
 	}
 	r.IdentityServerCert = cmdhelper.NormalizePath(val)
 }
 func SetZitiRouterIdentityKey(r *RouterTemplateValues, routerName string) {
 	val := os.Getenv(constants.ZitiRouterIdentityKeyVarName)
 	if val == "" {
-		val = workingDir + "/" + routerName + ".key" // default
+		val = helpers2.GetZitiHome() + "/" + routerName + ".key" // default
 	}
 	r.IdentityKey = cmdhelper.NormalizePath(val)
 }
 func SetZitiRouterIdentityCA(r *RouterTemplateValues, routerName string) {
 	val := os.Getenv(constants.ZitiRouterIdentityCAVarName)
 	if val == "" {
-		val = workingDir + "/" + routerName + ".cas" // default
+		val = cmdhelper.GetZitiHome() + "/" + routerName + ".cas" // default
 	}
 	r.IdentityCA = cmdhelper.NormalizePath(val)
 }
@@ -104,6 +104,6 @@ func SetRouterAltServerCerts(c *RouterTemplateValues) {
 		return //exit unless both vars are set
 	}
 	c.AltCertsEnabled = true
-	c.AltServerCert = helpers2.NormalizePath(altServerCert)
-	c.AltServerKey = helpers2.NormalizePath(altServerKey)
+	c.AltServerCert = cmdhelper.NormalizePath(altServerCert)
+	c.AltServerKey = cmdhelper.NormalizePath(altServerKey)
 }
diff --git a/ziti/cmd/create_config_router_edge.go b/ziti/cmd/create/create_config_router_edge.go
similarity index 99%
rename from ziti/cmd/create_config_router_edge.go
rename to ziti/cmd/create/create_config_router_edge.go
index a823ca6c3..02e96b40d 100644
--- a/ziti/cmd/create_config_router_edge.go
+++ b/ziti/cmd/create/create_config_router_edge.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	_ "embed"
diff --git a/ziti/cmd/create_config_router_edge_test.go b/ziti/cmd/create/create_config_router_edge_test.go
similarity index 99%
rename from ziti/cmd/create_config_router_edge_test.go
rename to ziti/cmd/create/create_config_router_edge_test.go
index c905a48b4..f59c0e871 100644
--- a/ziti/cmd/create_config_router_edge_test.go
+++ b/ziti/cmd/create/create_config_router_edge_test.go
@@ -1,4 +1,4 @@
-package cmd
+package create
 
 import (
 	"github.com/openziti/ziti/ziti/constants"
diff --git a/ziti/cmd/create_config_router_fabric.go b/ziti/cmd/create/create_config_router_fabric.go
similarity index 99%
rename from ziti/cmd/create_config_router_fabric.go
rename to ziti/cmd/create/create_config_router_fabric.go
index 395229a72..7ede483ac 100644
--- a/ziti/cmd/create_config_router_fabric.go
+++ b/ziti/cmd/create/create_config_router_fabric.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package create
 
 import (
 	_ "embed"
diff --git a/ziti/cmd/create_config_router_fabric_test.go b/ziti/cmd/create/create_config_router_fabric_test.go
similarity index 99%
rename from ziti/cmd/create_config_router_fabric_test.go
rename to ziti/cmd/create/create_config_router_fabric_test.go
index fbb49ab2b..b703fa644 100644
--- a/ziti/cmd/create_config_router_fabric_test.go
+++ b/ziti/cmd/create/create_config_router_fabric_test.go
@@ -1,4 +1,4 @@
-package cmd
+package create
 
 import (
 	"github.com/openziti/ziti/ziti/constants"
diff --git a/ziti/cmd/create_config_router_test.go b/ziti/cmd/create/create_config_router_test.go
similarity index 96%
rename from ziti/cmd/create_config_router_test.go
rename to ziti/cmd/create/create_config_router_test.go
index b90a906ec..c150de56e 100644
--- a/ziti/cmd/create_config_router_test.go
+++ b/ziti/cmd/create/create_config_router_test.go
@@ -1,7 +1,8 @@
-package cmd
+package create
 
 import (
 	"fmt"
+	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/constants"
 	"github.com/stretchr/testify/assert"
 	"gopkg.in/yaml.v3"
@@ -137,7 +138,7 @@ func TestSetZitiRouterIdentityCertDefault(t *testing.T) {
 	_ = os.Setenv(constants.ZitiRouterIdentityCertVarName, "")
 
 	routerName := "RouterTest"
-	expectedDefault := workingDir + "/" + routerName + ".cert"
+	expectedDefault := cmdhelper.GetZitiHome() + "/" + routerName + ".cert"
 	rtv := &RouterTemplateValues{}
 	SetZitiRouterIdentityCert(rtv, routerName)
 
@@ -162,7 +163,7 @@ func TestSetZitiRouterIdentityServerCertDefault(t *testing.T) {
 	_ = os.Setenv(constants.ZitiRouterIdentityServerCertVarName, "")
 
 	routerName := "RouterTest"
-	expectedDefault := workingDir + "/" + routerName + ".server.chain.cert"
+	expectedDefault := cmdhelper.GetZitiHome() + "/" + routerName + ".server.chain.cert"
 	rtv := &RouterTemplateValues{}
 	SetZitiRouterIdentityServerCert(rtv, routerName)
 
@@ -187,7 +188,7 @@ func TestSetZitiRouterIdentityKeyCertDefault(t *testing.T) {
 	_ = os.Setenv(constants.ZitiRouterIdentityKeyVarDescription, "")
 
 	routerName := "RouterTest"
-	expectedDefault := workingDir + "/" + routerName + ".key"
+	expectedDefault := cmdhelper.GetZitiHome() + "/" + routerName + ".key"
 	rtv := &RouterTemplateValues{}
 	SetZitiRouterIdentityKey(rtv, routerName)
 
@@ -212,7 +213,7 @@ func TestSetZitiRouterIdentityKeyCADefault(t *testing.T) {
 	_ = os.Setenv(constants.ZitiRouterIdentityCAVarName, "")
 
 	routerName := "RouterTest"
-	expectedDefault := workingDir + "/" + routerName + ".cas"
+	expectedDefault := cmdhelper.GetZitiHome() + "/" + routerName + ".cas"
 	rtv := &RouterTemplateValues{}
 	SetZitiRouterIdentityCA(rtv, routerName)
 
diff --git a/ziti/cmd/create_config_test.go b/ziti/cmd/create/create_config_test.go
similarity index 99%
rename from ziti/cmd/create_config_test.go
rename to ziti/cmd/create/create_config_test.go
index cefa8032c..69cbb777e 100644
--- a/ziti/cmd/create_config_test.go
+++ b/ziti/cmd/create/create_config_test.go
@@ -1,4 +1,4 @@
-package cmd
+package create
 
 import (
 	"bytes"
diff --git a/ziti/cmd/edge/create.go b/ziti/cmd/edge/create.go
index e159d08ac..028ae39bf 100644
--- a/ziti/cmd/edge/create.go
+++ b/ziti/cmd/edge/create.go
@@ -45,7 +45,7 @@ func newCreateCmd(out io.Writer, errOut io.Writer) *cobra.Command {
 	cmd.AddCommand(newCreateCaCmd(out, errOut))
 	cmd.AddCommand(newCreateConfigCmd(out, errOut))
 	cmd.AddCommand(newCreateConfigTypeCmd(out, errOut))
-	cmd.AddCommand(newCreateEdgeRouterCmd(out, errOut))
+	cmd.AddCommand(NewCreateEdgeRouterCmd(out, errOut))
 	cmd.AddCommand(newCreateEdgeRouterPolicyCmd(out, errOut))
 	cmd.AddCommand(newCreateEnrollmentCmd(out, errOut))
 	cmd.AddCommand(newCreateIdentityCmd(out, errOut))
diff --git a/ziti/cmd/edge/create_edge_router.go b/ziti/cmd/edge/create_edge_router.go
index 1e114264a..abc7d3779 100644
--- a/ziti/cmd/edge/create_edge_router.go
+++ b/ziti/cmd/edge/create_edge_router.go
@@ -37,7 +37,7 @@ type createEdgeRouterOptions struct {
 	disabled          bool
 }
 
-func newCreateEdgeRouterCmd(out io.Writer, errOut io.Writer) *cobra.Command {
+func NewCreateEdgeRouterCmd(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &createEdgeRouterOptions{
 		EntityOptions: api.NewEntityOptions(out, errOut),
 	}
diff --git a/ziti/cmd/edge/login.go b/ziti/cmd/edge/login.go
index 9f1fb81dc..3147c72cc 100644
--- a/ziti/cmd/edge/login.go
+++ b/ziti/cmd/edge/login.go
@@ -51,8 +51,8 @@ type LoginOptions struct {
 	ExtJwt       string
 }
 
-// newLoginCmd creates the command
-func newLoginCmd(out io.Writer, errOut io.Writer) *cobra.Command {
+// NewLoginCmd creates the command
+func NewLoginCmd(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &LoginOptions{
 		Options: api.Options{
 			CommonOptions: common.CommonOptions{Out: out, Err: errOut},
diff --git a/ziti/cmd/edge/quickstart.go b/ziti/cmd/edge/quickstart.go
new file mode 100644
index 000000000..f05cf1f7b
--- /dev/null
+++ b/ziti/cmd/edge/quickstart.go
@@ -0,0 +1,244 @@
+/*
+	Copyright NetFoundry Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package edge
+
+import (
+	"fmt"
+	edgeSubCmd "github.com/openziti/edge/controller/subcmd"
+	"github.com/openziti/ziti/common/version"
+	"github.com/openziti/ziti/ziti/cmd/create"
+	"github.com/openziti/ziti/ziti/cmd/helpers"
+	"github.com/openziti/ziti/ziti/cmd/pki"
+	controller2 "github.com/openziti/ziti/ziti/controller"
+	"github.com/openziti/ziti/ziti/router"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"io"
+	"os"
+	"time"
+)
+
+// newCreateCmd creates a command object for the "create" command
+func newQuickStartCmd(out io.Writer, errOut io.Writer) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "quickstart",
+		Short: "runs a Controller and Router in quickstart mode",
+		Long:  "runs a Controller and Router in quickstart mode. A totally ephemeral network only valid while running.",
+		Run: func(cmd *cobra.Command, args []string) {
+			run(out, errOut)
+		},
+	}
+
+	return cmd
+}
+
+func removeTempDir(tmpDir string) {
+	fmt.Println("Removing temp directory at: " + tmpDir)
+	_ = os.RemoveAll(tmpDir)
+}
+
+func run(out io.Writer, errOut io.Writer) {
+	tmpDir, _ := os.MkdirTemp("", "quickstart")
+
+	defer removeTempDir(tmpDir)
+
+	ctrlYaml := tmpDir + "/ctrl.yaml"
+
+	//ZITI_HOME=/tmp ziti create config controller | grep -v "#" | sed -E 's/^ *$//g' | sed '/^$/d'
+	_ = os.Setenv("ZITI_HOME", tmpDir)
+	_ = os.Setenv("ZITI_PKI_CTRL_CA", tmpDir+"/pki/root-ca/certs/root-ca.cert")
+	_ = os.Setenv("ZITI_PKI_CTRL_KEY", tmpDir+"/pki/intermediate-ca/keys/server.key")
+	_ = os.Setenv("ZITI_PKI_CTRL_CERT", tmpDir+"/pki/intermediate-ca/certs/client.cert")
+	_ = os.Setenv("ZITI_PKI_SIGNER_CERT", tmpDir+"/pki/intermediate-ca/certs/intermediate-ca.cert")
+	_ = os.Setenv("ZITI_PKI_SIGNER_KEY", tmpDir+"/pki/intermediate-ca/keys/intermediate-ca.key")
+	_ = os.Setenv("ZITI_PKI_CTRL_SERVER_CERT", tmpDir+"/pki/intermediate-ca/certs/server.chain.pem")
+
+	dbDir := tmpDir + "/db"
+	_, _ = fmt.Fprintf(os.Stdout, "creating the tmp dir [%v] for the database.\n\n", dbDir)
+	_ = os.MkdirAll(dbDir, 0o777)
+
+	createMinimalPki(out, errOut)
+
+	ctrl := create.NewCmdCreateConfigController()
+	ctrl.SetArgs([]string{
+		fmt.Sprintf("--output=%s", ctrlYaml),
+	})
+	_ = ctrl.Execute()
+
+	initCmd := edgeSubCmd.NewEdgeInitializeCmd(version.GetCmdBuildInfo())
+	initCmd.SetArgs([]string{
+		fmt.Sprintf("--username=%s", "admin"),
+		fmt.Sprintf("--password=%s", "admin"),
+		fmt.Sprintf(ctrlYaml),
+	})
+	initErr := initCmd.Execute()
+	if initErr != nil {
+		logrus.Fatal(initErr)
+	}
+
+	go func() {
+		runCtrl := controller2.NewRunCmd()
+		runCtrl.SetArgs([]string{
+			fmt.Sprintf(ctrlYaml),
+		})
+		runCtrlErr := runCtrl.Execute()
+		if runCtrlErr != nil {
+			logrus.Fatal(runCtrlErr)
+		}
+	}()
+
+	fmt.Println("Controller running... Configuring and starting Router...")
+	time.Sleep(5 * time.Second)
+
+	//ziti edge login https://localhost:1280 -u admin -p admin -y
+	loginCmd := NewLoginCmd(out, errOut)
+	loginCmd.SetArgs([]string{
+		fmt.Sprintf("localhost:1280"),
+		fmt.Sprintf("--username=%s", "admin"),
+		fmt.Sprintf("--password=%s", "admin"),
+		fmt.Sprintf("-y"),
+	})
+	loginErr := loginCmd.Execute()
+	if loginErr != nil {
+		logrus.Fatal(loginErr)
+	}
+
+	//./ziti edge create edge-router ${ZITI_HOSTNAME}-edge-router -o ${ZITI_HOME}/${ZITI_HOSTNAME}-edge-router.jwt -t -a public
+	createErCmd := NewCreateEdgeRouterCmd(out, errOut)
+	erJwt := tmpDir + "/quickstart.er.jwt"
+	createErCmd.SetArgs([]string{
+		fmt.Sprintf("quickstart-router"),
+		fmt.Sprintf("--jwt-output-file=%s", erJwt),
+		fmt.Sprintf("--tunneler-enabled"),
+		fmt.Sprintf("--role-attributes=%s", "public"),
+	})
+	createErErr := createErCmd.Execute()
+	if createErErr != nil {
+		logrus.Fatal(createErErr)
+	}
+
+	//./ziti create config router edge --routerName ${ZITI_HOSTNAME}-edge-router >${ZITI_HOME}/${ZITI_HOSTNAME}-edge-router.yaml
+	opts := &create.CreateConfigRouterOptions{}
+
+	data := &create.ConfigTemplateValues{}
+	data.PopulateConfigValues()
+	create.SetZitiRouterIdentity(&data.Router, "quickstart-router")
+	erCfg := create.NewCmdCreateConfigRouterEdge(opts, data)
+	erYaml := tmpDir + "/quickstart.er.yaml"
+	erCfg.SetArgs([]string{
+		fmt.Sprintf("--routerName=%s", "quickstart-router"),
+		fmt.Sprintf("--output=%s", erYaml),
+	})
+	_ = ctrl.Execute()
+	erCfgErr := erCfg.Execute()
+	if erCfgErr != nil {
+		logrus.Fatal(erCfgErr)
+	}
+
+	//./ziti router enroll ${ZITI_HOME}/${ZITI_HOSTNAME}-edge-router.yaml --jwt ${ZITI_HOME}/${ZITI_HOSTNAME}-edge-router.jwt
+	erEnroll := router.NewEnrollGwCmd()
+	erEnroll.SetArgs([]string{
+		fmt.Sprintf(erYaml),
+		fmt.Sprintf("--jwt=%s", erJwt),
+	})
+	erEnrollErr := erEnroll.Execute()
+	if erEnrollErr != nil {
+		logrus.Fatal(erEnrollErr)
+	}
+
+	//./ziti router run ${ZITI_HOME}/${ZITI_HOSTNAME}-edge-router.yaml &> ${ZITI_HOME}/${ZITI_HOSTNAME}-edge-router.log &
+	erRunCmd := router.NewRunCmd()
+	erRunCmd.SetArgs([]string{
+		fmt.Sprintf(erYaml),
+	})
+	erRunCmdErr := erRunCmd.Execute()
+	if erRunCmdErr != nil {
+		logrus.Fatal(erRunCmdErr)
+	}
+}
+
+func createMinimalPki(out io.Writer, errOut io.Writer) {
+	tmpDir := os.Getenv("ZITI_HOME")
+	pkiDir := tmpDir + "/pki"
+	fmt.Println("emitting a minimal PKI:")
+
+	//ziti pki create ca --pki-root="$pkiDir" --ca-file="root-ca" --ca-name="root-ca"
+	ca := pki.NewCmdPKICreateCA(out, errOut)
+	ca.SetArgs([]string{
+		fmt.Sprintf("--pki-root=%s", pkiDir),
+		fmt.Sprintf("--ca-file=%s", "root-ca"),
+		fmt.Sprintf("--ca-name=%s", "root-ca"),
+	})
+	pkiErr := ca.Execute()
+	if pkiErr != nil {
+		logrus.Fatal(pkiErr)
+	}
+
+	//ziti pki create intermediate --pki-root "$pkiDir" --ca-name "root-ca" --intermediate-name "intermediate-ca" --intermediate-file "intermediate-ca" --max-path-len "1"
+	intermediate := pki.NewCmdPKICreateIntermediate(out, errOut)
+	intermediate.SetArgs([]string{
+		fmt.Sprintf("--pki-root=%s", pkiDir),
+		fmt.Sprintf("--ca-name=%s", "root-ca"),
+		fmt.Sprintf("--intermediate-name=%s", "intermediate-ca"),
+		fmt.Sprintf("--intermediate-file=%s", "intermediate-ca"),
+		fmt.Sprintf("--max-path-len=1"),
+	})
+	intErr := intermediate.Execute()
+	if intErr != nil {
+		logrus.Fatal(intErr)
+	}
+
+	//ziti pki create server --pki-root="${ZITI_HOME}/pki" --ca-name "intermediate-ca" --server-name "server" --server-file "server" --dns "localhost,${ZITI_HOSTNAME}"
+	svr := pki.NewCmdPKICreateServer(out, errOut)
+	svr.SetArgs([]string{
+		fmt.Sprintf("--pki-root=%s", pkiDir),
+		fmt.Sprintf("--ca-name=%s", "intermediate-ca"),
+		fmt.Sprintf("--server-name=%s", "server"),
+		fmt.Sprintf("--server-file=%s", "server"),
+		fmt.Sprintf("--dns=%s,%s", "localhost", helpers.GetCtrlAdvertisedAddress()),
+	})
+	svrErr := svr.Execute()
+	if svrErr != nil {
+		logrus.Fatal(svrErr)
+	}
+
+	//ziti pki create client --pki-root="${ZITI_HOME}/pki" --ca-name "intermediate-ca" --client-name "client" --client-file "client" --key-file "server"
+	client := pki.NewCmdPKICreateClient(out, errOut)
+	client.SetArgs([]string{
+		fmt.Sprintf("--pki-root=%s", pkiDir),
+		fmt.Sprintf("--ca-name=%s", "intermediate-ca"),
+		fmt.Sprintf("--client-name=%s", "client"),
+		fmt.Sprintf("--client-file=%s", "client"),
+		fmt.Sprintf("--key-file=%s", "server"),
+	})
+	clientErr := client.Execute()
+	if clientErr != nil {
+		logrus.Fatal(clientErr)
+	}
+
+}
+
+//func waitForShutdown(fabricController *controller.Controller, edgeController *server.Controller) {
+//	ch := make(chan os.Signal, 1)
+//	signal.Notify(ch, os.Interrupt, syscall.SIGTERM)
+//
+//	<-ch
+//
+//	pfxlog.Logger().Info("shutting down ziti-controller")
+//	edgeController.Shutdown()
+//	fabricController.Shutdown()
+//}
diff --git a/ziti/cmd/edge/root.go b/ziti/cmd/edge/root.go
index 7938d8936..36bbfbbf5 100644
--- a/ziti/cmd/edge/root.go
+++ b/ziti/cmd/edge/root.go
@@ -37,7 +37,7 @@ func NewCmdEdge(out io.Writer, errOut io.Writer) *cobra.Command {
 func populateEdgeCommands(out io.Writer, errOut io.Writer, cmd *cobra.Command) *cobra.Command {
 	cmd.AddCommand(newCreateCmd(out, errOut))
 	cmd.AddCommand(newDeleteCmd(out, errOut))
-	cmd.AddCommand(newLoginCmd(out, errOut))
+	cmd.AddCommand(NewLoginCmd(out, errOut))
 	cmd.AddCommand(newLogoutCmd(out, errOut))
 	cmd.AddCommand(newUseCmd(out, errOut))
 	cmd.AddCommand(newListCmd(out, errOut))
@@ -50,6 +50,7 @@ func populateEdgeCommands(out io.Writer, errOut io.Writer, cmd *cobra.Command) *
 	cmd.AddCommand(newTraceRouteCmd(out, errOut))
 	cmd.AddCommand(newShowCmd(out, errOut))
 	cmd.AddCommand(newReEnrollCmd(out, errOut))
+	cmd.AddCommand(newQuickStartCmd(out, errOut))
 
 	p := common.NewOptionsProvider(out, errOut)
 	cmd.AddCommand(enrollment.NewEnrollCommand(p))
diff --git a/ziti/cmd/helpers/env_helpers.go b/ziti/cmd/helpers/env_helpers.go
index 17f26fcc2..1cfc48417 100644
--- a/ziti/cmd/helpers/env_helpers.go
+++ b/ziti/cmd/helpers/env_helpers.go
@@ -46,7 +46,7 @@ func WorkingDir() (string, error) {
 	return NormalizePath(wd), nil
 }
 
-func GetZitiHome() (string, error) {
+func GetZitiHome() string {
 	// Get path from env variable
 	retVal := os.Getenv(constants.ZitiHomeVarName)
 
@@ -59,14 +59,10 @@ func GetZitiHome() (string, error) {
 		}
 
 		err = os.Setenv(constants.ZitiHomeVarName, workingDir)
-		if err != nil {
-			return "", err
-		}
-
 		retVal = os.Getenv(constants.ZitiHomeVarName)
 	}
 
-	return NormalizePath(retVal), nil
+	return NormalizePath(retVal)
 }
 
 func HostnameOrNetworkName() string {
diff --git a/ziti/cmd/log_filter.go b/ziti/cmd/log_filter.go
index fbee7b723..ed63654ce 100644
--- a/ziti/cmd/log_filter.go
+++ b/ziti/cmd/log_filter.go
@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"github.com/michaelquigley/pfxlog"
+	"github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/spf13/cobra"
 	"io"
@@ -26,7 +27,7 @@ import (
 
 // LogFormatOptions contains the command line options
 type LogFormatOptions struct {
-	CommonOptions
+	common.CommonOptions
 
 	absoluteTime bool
 	trimPrefix   string
@@ -35,7 +36,7 @@ type LogFormatOptions struct {
 // NewCmdLogFormat a command object for the "log-format" command
 func NewCmdLogFormat(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &LogFormatOptions{
-		CommonOptions: CommonOptions{
+		CommonOptions: common.CommonOptions{
 			Out: out,
 			Err: errOut,
 		},
diff --git a/ziti/cmd/pki.go b/ziti/cmd/pki/pki.go
similarity index 95%
rename from ziti/cmd/pki.go
rename to ziti/cmd/pki/pki.go
index 28c5a1a90..a26b8a8f9 100644
--- a/ziti/cmd/pki.go
+++ b/ziti/cmd/pki/pki.go
@@ -14,9 +14,10 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
+	"github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/cmd/lets_encrypt"
 	"github.com/openziti/ziti/ziti/cmd/templates"
@@ -27,7 +28,7 @@ import (
 
 // PKIOptions contains the command line options
 type PKIOptions struct {
-	CommonOptions
+	common.CommonOptions
 
 	Flags PKIFlags
 }
@@ -73,7 +74,7 @@ Provide the components needed to manage a Ziti PKI.
 // NewCmdPKI PKIs a command object for the "PKI" command
 func NewCmdPKI(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &PKIOptions{
-		CommonOptions: CommonOptions{
+		CommonOptions: common.CommonOptions{
 			Out: out,
 			Err: errOut,
 		},
diff --git a/ziti/cmd/pki_create.go b/ziti/cmd/pki/pki_create.go
similarity index 98%
rename from ziti/cmd/pki_create.go
rename to ziti/cmd/pki/pki_create.go
index 93aaeed44..8fc6a6ad3 100644
--- a/ziti/cmd/pki_create.go
+++ b/ziti/cmd/pki/pki_create.go
@@ -14,7 +14,7 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
 	"crypto/elliptic"
@@ -23,6 +23,7 @@ import (
 	"encoding/asn1"
 	"errors"
 	"fmt"
+	cmd2 "github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/pki/pki"
 	"github.com/openziti/ziti/ziti/util"
@@ -49,7 +50,7 @@ type PKICreateOptions struct {
 func NewCmdPKICreate(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &PKICreateOptions{
 		PKIOptions: PKIOptions{
-			CommonOptions: CommonOptions{
+			CommonOptions: cmd2.CommonOptions{
 				Out: out,
 				Err: errOut,
 			},
@@ -459,3 +460,9 @@ func (o *PKICreateOptions) obtainRsaOptions() (pki.PrivateKeyOptions, error) {
 		Size: o.Flags.CAPrivateKeySize,
 	}, nil
 }
+
+func (options *PKICreateOptions) panicOnErr(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
diff --git a/ziti/cmd/pki_create_ca.go b/ziti/cmd/pki/pki_create_ca.go
similarity index 97%
rename from ziti/cmd/pki_create_ca.go
rename to ziti/cmd/pki/pki_create_ca.go
index 581fdb26d..8a0c6cabe 100644
--- a/ziti/cmd/pki_create_ca.go
+++ b/ziti/cmd/pki/pki_create_ca.go
@@ -14,11 +14,12 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
 	"fmt"
 	"github.com/openziti/fabric/controller/idgen"
+	cmd2 "github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/internal/log"
 	"github.com/openziti/ziti/ziti/pki/certificate"
@@ -41,7 +42,7 @@ func NewCmdPKICreateCA(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &PKICreateCAOptions{
 		PKICreateOptions: PKICreateOptions{
 			PKIOptions: PKIOptions{
-				CommonOptions: CommonOptions{
+				CommonOptions: cmd2.CommonOptions{
 					Out: out,
 					Err: errOut,
 				},
@@ -97,7 +98,7 @@ func (o *PKICreateCAOptions) Run() error {
 		//default name, ensure uniqueness by adding a random id
 		o.Flags.CAName = o.Flags.CAName + " " + idgen.New()
 	}
-
+	
 	commonName := o.Flags.CAName
 
 	filename := o.ObtainFileName(caFile, commonName)
diff --git a/ziti/cmd/pki_create_client.go b/ziti/cmd/pki/pki_create_client.go
similarity index 98%
rename from ziti/cmd/pki_create_client.go
rename to ziti/cmd/pki/pki_create_client.go
index 56162265a..8667aa840 100644
--- a/ziti/cmd/pki_create_client.go
+++ b/ziti/cmd/pki/pki_create_client.go
@@ -14,11 +14,12 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
 	"fmt"
 	"github.com/openziti/fabric/controller/idgen"
+	cmd2 "github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/internal/log"
 	"github.com/openziti/ziti/ziti/pki/certificate"
@@ -40,7 +41,7 @@ func NewCmdPKICreateClient(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &PKICreateClientOptions{
 		PKICreateOptions: PKICreateOptions{
 			PKIOptions: PKIOptions{
-				CommonOptions: CommonOptions{
+				CommonOptions: cmd2.CommonOptions{
 					Out: out,
 					Err: errOut,
 				},
diff --git a/ziti/cmd/pki_create_csr.go b/ziti/cmd/pki/pki_create_csr.go
similarity index 96%
rename from ziti/cmd/pki_create_csr.go
rename to ziti/cmd/pki/pki_create_csr.go
index 99cfc7523..ee9b266e7 100644
--- a/ziti/cmd/pki_create_csr.go
+++ b/ziti/cmd/pki/pki_create_csr.go
@@ -14,10 +14,11 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
 	"fmt"
+	cmd2 "github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/internal/log"
 	"github.com/openziti/ziti/ziti/pki/pki"
@@ -36,7 +37,7 @@ func NewCmdPKICreateCSR(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &PKICreateCSROptions{
 		PKICreateOptions: PKICreateOptions{
 			PKIOptions: PKIOptions{
-				CommonOptions: CommonOptions{
+				CommonOptions: cmd2.CommonOptions{
 					Out: out,
 					Err: errOut,
 				},
diff --git a/ziti/cmd/pki_create_intermediate.go b/ziti/cmd/pki/pki_create_intermediate.go
similarity index 97%
rename from ziti/cmd/pki_create_intermediate.go
rename to ziti/cmd/pki/pki_create_intermediate.go
index 2f80ad773..375abb1b6 100644
--- a/ziti/cmd/pki_create_intermediate.go
+++ b/ziti/cmd/pki/pki_create_intermediate.go
@@ -14,11 +14,12 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
 	"fmt"
 	"github.com/openziti/fabric/controller/idgen"
+	cmd2 "github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/internal/log"
 	"github.com/openziti/ziti/ziti/pki/certificate"
@@ -39,7 +40,7 @@ func NewCmdPKICreateIntermediate(out io.Writer, errOut io.Writer) *cobra.Command
 	options := &PKICreateIntermediateOptions{
 		PKICreateOptions: PKICreateOptions{
 			PKIOptions: PKIOptions{
-				CommonOptions: CommonOptions{
+				CommonOptions: cmd2.CommonOptions{
 					Out: out,
 					Err: errOut,
 				},
diff --git a/ziti/cmd/pki_create_key.go b/ziti/cmd/pki/pki_create_key.go
similarity index 97%
rename from ziti/cmd/pki_create_key.go
rename to ziti/cmd/pki/pki_create_key.go
index e2ff8b018..c708a4ac8 100644
--- a/ziti/cmd/pki_create_key.go
+++ b/ziti/cmd/pki/pki_create_key.go
@@ -14,10 +14,11 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
 	"fmt"
+	cmd2 "github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/internal/log"
 	"github.com/openziti/ziti/ziti/pki/certificate"
@@ -37,7 +38,7 @@ func NewCmdPKICreateKey(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &PKICreateKeyOptions{
 		PKICreateOptions: PKICreateOptions{
 			PKIOptions: PKIOptions{
-				CommonOptions: CommonOptions{
+				CommonOptions: cmd2.CommonOptions{
 					Out: out,
 					Err: errOut,
 				},
diff --git a/ziti/cmd/pki_create_server.go b/ziti/cmd/pki/pki_create_server.go
similarity index 98%
rename from ziti/cmd/pki_create_server.go
rename to ziti/cmd/pki/pki_create_server.go
index 98deef32d..0132d0af0 100644
--- a/ziti/cmd/pki_create_server.go
+++ b/ziti/cmd/pki/pki_create_server.go
@@ -14,11 +14,12 @@
 	limitations under the License.
 */
 
-package cmd
+package pki
 
 import (
 	"fmt"
 	"github.com/openziti/fabric/controller/idgen"
+	cmd2 "github.com/openziti/ziti/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/internal/log"
 	"github.com/openziti/ziti/ziti/pki/certificate"
@@ -40,7 +41,7 @@ func NewCmdPKICreateServer(out io.Writer, errOut io.Writer) *cobra.Command {
 	options := &PKICreateServerOptions{
 		PKICreateOptions: PKICreateOptions{
 			PKIOptions: PKIOptions{
-				CommonOptions: CommonOptions{
+				CommonOptions: cmd2.CommonOptions{
 					Out: out,
 					Err: errOut,
 				},