Where Does OpenZiti Store Identities and Config?
OpenZiti tunneler identity directory on Linux and where enrolled identity JSON files live.
Last updated
OpenZiti has two kinds of files and they live in different places. Controller and router configs are YAML you wrote during setup, with identity sections pointing at PEM certs and keys. Endpoint identities are JSON files produced by enrollment.
On a Linux tunneler host the identities directory is the location that matters. Drop a .jwt enrollment token in, enroll, and the tunneler manages the resulting JSON (including cert renewal). The directory must stay group writable for ziti and closed to others, since each file embeds a private key.
Where OpenZiti stores this, by platform
/opt/openziti/etc/identities
Default --identity-dir for ziti-edge-tunnel. Add with ziti-edge-tunnel add --jwt, or place *.jwt for auto enrollment at next start. Then chown :ziti and chmod ug=rwX,o-rwx, and restart the tunneler when files change.
Frequently asked questions
where does ziti edge enroll save the identity file
Wherever your --out flag points, for example ./myTunneler.json from ziti edge enroll --jwt myTunneler.jwt --out myTunneler.json. That JSON holds the private key. Store it securely and never share it between machines.
where is the ziti CLI state file
The CLI caches session info at ~/.config/ziti/ziti-cli.json after login. It is convenience state, not the identity itself. The enrolled identity JSON from the previous answer is the file that actually authenticates.
Notice an outdated path? Let us know.