search

openziti-test-kitchen / zssh

Ziti SSH
Apache License 2.0
35 stars 7 forks source link

ENROLL function is broken #20

Closed NicFragale closed 2 years ago

NicFragale commented 2 years ago

Specifying "./zssh enroll XXX.jwt" appears to work initially, but fails shortly after with the usage statement of the program. Enrollment does not complete and does not produce a JSON configuration.

dovholuknf commented 2 years ago

I will try on macos x86 but on windows it completed fine:

zssh-windows-amd64.exe enroll c:\temp\aa.jwt
INFO    generating 4096 bit RSA key
INFO    enrolled successfully. identity file written to: c:\temp\aa.json
dovholuknf commented 2 years ago

works on mac amd x86/x64 too... Could the jwt have been invalid/old?

➜  ~ ./zssh-macos-amd64 enroll macaa.jwt
INFO    generating 4096 bit RSA key
INFO    enrolled successfully. identity file written to: macaa.json
dovholuknf commented 2 years ago

I pushed v0.0.13 out https://github.com/openziti-test-kitchen/zssh/releases/tag/0.0.13

image

You'll now see 'why' enrollment failed.

NicFragale commented 2 years ago

@dovholuknf This illuminated the issue Clint!

For reference. I recreated the JWT. Without modifying it, I referenced it in the enroll process again and it produced the following. Now I need to understand why it is thinking its not a standards compliant certificate when generated by MOP.

ERROR failed to enroll: Post "....fc4008ca.production.netfoundry.io:443/enroll?method=ott&token=....": x509: “150.136.233.219” certificate is not standards compliant