Overview

NetFoundry developed OpenZiti to bring zero-trust networking directly into software rather than hardware perimeters or proprietary cloud gateways. The project shifts the security boundary into applications, routing traffic across controllers, edge routers, and lightweight endpoints. Today, that architecture lets teams close all inbound firewall ports and embed private connectivity into distributed services.

Why OpenZiti instead of Cloudflare Zero Trust

Cloudflare Zero Trust proxies private traffic through its global anycast network, terminating sessions on Cloudflare-managed servers. For dispersed teams accessing internal tools, Cloudflare offers widespread ingress, but it introduces an extra hop for internal service-to-service communication. When two microservices run in the same data center or VPC, routing packets through a commercial edge adds latency and consumes external bandwidth. OpenZiti runs on self-hosted edge routers deployed directly on your infrastructure, routing internal traffic over local networks with end-to-end encryption and zero external hair-pinning.

At the client layer, Cloudflare Zero Trust and Twingate rely on host connectors and virtual network interfaces that require OS-level packet interception. OpenZiti supports host tunnelers, but also provides application SDKs in Go, C, Python, and Java. Embedding the overlay lets applications establish private circuits in-process without virtual network adapters or listening ports on localhost. That control shifts operations to your team: while Cloudflare manages capacity invisibly, OpenZiti requires sizing your own routers, where multi-stream throughput can saturate buffers under heavy load.

What it does well

Application-embedded SDKs: Developers compile zero-trust connectivity into Go, C, Python, Java, or C# binaries, handling in-process mTLS without virtual network adapters.
Dark service architecture: Outbound-only router connections ensure services expose zero inbound ports, removing public attack surface from internet scanners.
Centralized policy engine: Administrators define least-privilege access rules on the controller, immediately terminating active circuits when credentials expire.
Tiered deployment options: Mixes network gateways, host-level tunnelers, and embedded SDKs on a single overlay to accommodate legacy and greenfield workloads.
Multi-cloud overlay fabric: Interconnects Kubernetes clusters, on-premises hosts, and cloud VPCs without cloud-specific VPN tunnels or complex peering.

services: caddy: image: caddy:2.11.7-alpine restart: unless-stopped ports: - "127.0.0.1:8080:80" entrypoint: - /bin/sh - -c - | cat <<'EOF' > /etc/caddy/Caddyfile :80 { reverse_proxy https://quickstart:1280 { transport http { tls_insecure_skip_verify } } } EOF exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile depends_on: quickstart: condition: service_healthy healthcheck: test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:80/edge/client/v1/version"] interval: 3s timeout: 3s retries: 20 start_period: 5s networks: - quickstart quickstart: image: openziti/ziti-controller:2.0.8 restart: unless-stopped networks: quickstart: aliases: - ${ZITI_CTRL_ADVERTISED_ADDRESS} - ${ZITI_ROUTER_ADVERTISED_ADDRESS} entrypoint: - bash - -euc - | exec ziti edge quickstart --home /home/ziggy/quickstart \ --ctrl-address "$${ZITI_CTRL_ADVERTISED_ADDRESS}" \ --ctrl-port 1280 \ --router-address "$${ZITI_ROUTER_ADVERTISED_ADDRESS}" \ --router-port 3022 \ --password "$${ZITI_PWD}" user: "1000:1000" environment: ZITI_PWD: ${ZITI_PWD} ZITI_CTRL_ADVERTISED_ADDRESS: ${ZITI_CTRL_ADVERTISED_ADDRESS} ZITI_ROUTER_ADVERTISED_ADDRESS: ${ZITI_ROUTER_ADVERTISED_ADDRESS} PFXLOG_NO_JSON: "true" ZITI_ROUTER_NAME: quickstart-router volumes: - ziti_home:/home/ziggy ports: - "1280:1280" - "3022:3022" depends_on: quickstart-init: condition: service_completed_successfully healthcheck: test: ["CMD-SHELL", "ziti edge list identities || exit 1"] interval: 3s timeout: 5s retries: 30 start_period: 10s quickstart-init: image: busybox:1.37.0 command: chown -R 1000:1000 /home/ziggy user: root volumes: - ziti_home:/home/ziggy networks: quickstart: volumes: ziti_home:

quickstart-1 | 2026-11-03T04:49:11.830382675Z [ 328.059] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43772] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.830471717Z [ 328.060] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57254] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.830475509Z [ 328.060] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57240] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.830504509Z [ 328.060] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57246]} handshake failed quickstart-1 | 2026-11-03T04:49:11.830525342Z [ 328.060] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43724] error=[tls: client didn't provide a certificate] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.830550634Z [ 328.060] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43748] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.830578592Z [ 328.060] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43740] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.840174342Z [ 328.069] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57276] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.840765092Z [ 328.070] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57278] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.840775800Z [ 328.070] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43756] error=[tls: client didn't provide a certificate] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.845717425Z [ 328.075] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:57270] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280]} handshake failed quickstart-1 | 2026-11-03T04:49:11.849914800Z [ 328.076] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43820]} handshake failed quickstart-1 | 2026-11-03T04:49:11.849917884Z [ 328.076] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43790]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850906967Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43734]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850908925Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57326] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850909675Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:43888] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850910342Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43786] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850911009Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57294]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850911634Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57308] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850912300Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57324] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850919342Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:43840] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.850920092Z [ 328.079] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43850] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.853037842Z [ 328.082] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43796]} handshake failed quickstart-1 | 2026-11-03T04:49:11.853088800Z [ 328.082] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43806] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.853180509Z [ 328.082] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57348] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.853242342Z [ 328.082] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43912] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.853491009Z [ 328.083] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57342] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.858776842Z [ 328.088] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43898]} handshake failed quickstart-1 | 2026-11-03T04:49:11.858825759Z [ 328.088] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43832]} handshake failed quickstart-1 | 2026-11-03T04:49:11.858870634Z [ 328.088] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43924] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.859725550Z [ 328.089] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57356] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.859727259Z [ 328.089] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43952] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.859748050Z [ 328.089] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43862] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.864417259Z [ 328.093] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57368] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.865629217Z [ 328.095] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43920] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.865684967Z [ 328.095] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43872]} handshake failed quickstart-1 | 2026-11-03T04:49:11.869254134Z [ 328.098] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43960] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.869294550Z [ 328.098] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57360] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.869342134Z [ 328.099] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44020] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.869366509Z [ 328.099] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43998] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.871232592Z [ 328.100] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43984]} handshake failed quickstart-1 | 2026-11-03T04:49:11.871283467Z [ 328.100] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43940] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.871423759Z [ 328.100] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57384]} handshake failed quickstart-1 | 2026-11-03T04:49:11.871431467Z [ 328.101] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:43974] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.871432342Z [ 328.101] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57372] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.871433009Z [ 328.101] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44024] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.874932300Z [ 328.104] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44038]} handshake failed quickstart-1 | 2026-11-03T04:49:11.874936592Z [ 328.104] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44010]} handshake failed quickstart-1 | 2026-11-03T04:49:11.879855675Z [ 328.109] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44062] error=[tls: client didn't provide a certificate] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.879915384Z [ 328.109] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57424] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.880031759Z [ 328.109] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44078] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.880032967Z [ 328.109] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57400]} handshake failed quickstart-1 | 2026-11-03T04:49:11.880061092Z [ 328.109] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57414] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.880172925Z [ 328.109] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44046] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.884765717Z [ 328.114] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44074] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.885074175Z [ 328.114] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57432] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.885075842Z [ 328.114] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44110] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.889849342Z [ 328.119] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44094] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.889984092Z [ 328.119] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44120] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.895254842Z [ 328.124] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44124] error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.895336884Z [ 328.124] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44184] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.895377384Z [ 328.125] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44168] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.895416634Z [ 328.125] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44140] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.895551675Z [ 328.125] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:57456] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280]} handshake failed quickstart-1 | 2026-11-03T04:49:11.895557300Z [ 328.125] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57448]} handshake failed quickstart-1 | 2026-11-03T04:49:11.900299675Z [ 328.129] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44154] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.902691967Z [ 328.132] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44196] error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.902694259Z [ 328.132] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57462] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.902695050Z [ 328.132] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44214] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.905548509Z [ 328.135] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44216]} handshake failed quickstart-1 | 2026-11-03T04:49:11.905582050Z [ 328.135] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44200]} handshake failed quickstart-1 | 2026-11-03T04:49:11.917686884Z [ 328.147] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44232] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.917864425Z [ 328.147] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44240] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.919384050Z [ 328.149] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44238] error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.921182300Z [ 328.150] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:57476] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280]} handshake failed quickstart-1 | 2026-11-03T04:49:11.921276092Z [ 328.150] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44244] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.926133259Z [ 328.155] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44252] error=[tls: client didn't provide a certificate] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.931467800Z [ 328.161] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44254] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.932636550Z [ 328.162] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57482] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.942017675Z [ 328.171] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44268] error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.955380675Z [ 328.185] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57494] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.964590384Z [ 328.194] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44284] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.964694259Z [ 328.194] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57510] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.966184300Z [ 328.195] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57522]} handshake failed quickstart-1 | 2026-11-03T04:49:11.971248009Z [ 328.200] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44304] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.971250509Z [ 328.200] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44320] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.971251425Z [ 328.200] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57538] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:11.971663800Z [ 328.201] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:44300] error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022]} handshake failed quickstart-1 | 2026-11-03T04:49:11.971698550Z [ 328.201] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44296] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.975818384Z [ 328.205] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44340] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:11.975825050Z [ 328.205] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44336] error=[tls: client didn't provide a certificate] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:11.976750300Z [ 328.206] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44354]} handshake failed quickstart-1 | 2026-11-03T04:49:12.839683217Z [ 329.068] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57544] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.841981592Z [ 329.069] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44360] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.842409009Z [ 329.071] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57548]} handshake failed quickstart-1 | 2026-11-03T04:49:12.847485426Z [ 329.076] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57564]} handshake failed quickstart-1 | 2026-11-03T04:49:12.851096301Z [ 329.080] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44378] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.851118884Z [ 329.080] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57574] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.851128092Z [ 329.080] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44376]} handshake failed quickstart-1 | 2026-11-03T04:49:12.865508384Z [ 329.095] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:57598] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280]} handshake failed quickstart-1 | 2026-11-03T04:49:12.875750217Z [ 329.105] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44420] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:12.875760384Z [ 329.105] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57586] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.875761509Z [ 329.105] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:1280] remote=[192.168.65.160:57596] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.877582926Z [ 329.107] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44430] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:12.877667759Z [ 329.107] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44450] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:12.877772676Z [ 329.107] ERROR transport/v2/tls.(*sharedListener).processConn: {remote=[192.168.65.160:57608] error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:1280]} handshake failed quickstart-1 | 2026-11-03T04:49:12.880577717Z [ 329.110] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44392]} handshake failed quickstart-1 | 2026-11-03T04:49:12.880763926Z [ 329.110] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44396] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.880840009Z [ 329.110] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: first record does not look like a TLS handshake] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44400]} handshake failed quickstart-1 | 2026-11-03T04:49:12.880841467Z [ 329.110] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44412] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.883150676Z [ 329.112] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44432] error=[tls: client didn't provide a certificate] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:12.883185592Z [ 329.112] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44436] error=[tls: first record does not look like a TLS handshake]} handshake failed quickstart-1 | 2026-11-03T04:49:12.885555051Z [ 329.115] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44418] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:12.885636509Z [ 329.115] ERROR transport/v2/tls.(*sharedListener).processConn: {channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44384] error=[tls: client didn't provide a certificate]} handshake failed quickstart-1 | 2026-11-03T04:49:12.888300176Z [ 329.117] ERROR transport/v2/tls.(*sharedListener).processConn: {endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44440] error=[tls: client didn't provide a certificate] channel=[transport.tls]} handshake failed quickstart-1 | 2026-11-03T04:49:12.891567467Z [ 329.120] ERROR transport/v2/tls.(*sharedListener).processConn: {error=[tls: client didn't provide a certificate] channel=[transport.tls] endpoint=[tls:0.0.0.0:3022] remote=[192.168.65.160:44452]} handshake failed quickstart-1 | 2026-11-03T04:49:24.226517791Z [ 340.457] INFO ziti/v2/router/state.(*ManagerImpl).checkRouterDataModelSubscription: {ctrlId=[instance-1] subscriptionId=[1Josw5LWJP] prevCtrlId=[instance-1]} current data model subscription expired, resubscribing quickstart-1 | 2026-11-03T04:49:24.226595833Z [ 340.457] INFO ziti/v2/router/state.(*ManagerImpl).subscribeToDataModelUpdates: {currentIndex=[15] renew=[true] subscriptionId=[1Josw5LWJP] ctrlId=[instance-1]} subscribed to new controller for router data model changes quickstart-1 | 2026-11-03T04:49:24.226694041Z [ 340.457] INFO ziti/v2/controller/handler_edge_ctrl.(*subscribeToDataModelHandler).HandleReceive: {timelineId=[h_IQ-b3Dg] routerId=[3zWsw5zWOP] index=[15]} data model subscription request received quickstart-1 | 2026-11-03T04:49:24.226742875Z [ 340.457] INFO ziti/v2/controller/sync_strats.(*RouterSender).handleSyncRequest: {requestedIndex=[15] currentIndex=[15] renew=[true] subscriptionDuration=[2026-11-03 04:54:24.226690375 +0000 UTC m=+640.482517657] timelineId=[h_IQ-b3Dg] subscriptionId=[1Josw5LWJP] routerId=[3zWsw5zWOP] routerName=[quickstart-router]} data model subscription started

OpenZiti

Overview

Why OpenZiti instead of Cloudflare Zero Trust

What it does well

Similar Open Source Tools

frp

Limitations

Who should use it

FAQ

Verdict

Self-host OpenZiti with Docker

Download the compose file

Create .env with fresh secrets

Start it

First run

Project README

GitHub Repository Metrics

Supported Platforms

Maintainer? Add the badge

Chisel

Rathole