OpenZiti

OpenZiti is an open-source zero-trust networking platform that makes network services invisible to unauthorized users. It uses cryptographic identity to authenticate every connection from users, services, devices, or workloads, ensuring that traffic is authorized by policy and encrypted end-to-end. By removing the reliance on IP addresses and firewall rules, it creates an overlay network where services do not expose listening ports to the public internet.

The software is deployed as a server-based overlay network that runs on top of existing IP infrastructure, including AWS, Azure, GCP, and on-premises data centers. It can be managed via a web-based admin console, a command-line interface, or through programmable REST APIs. Deployment is flexible, supporting Docker containers, Kubernetes clusters, and bare metal servers to facilitate secure connectivity across multi-cloud or hybrid environments.

Key features

• Cryptographic identity for users, services, devices, and non-human workloads
• Dark services with zero listening ports to eliminate attack surfaces
• End-to-end encryption using libsodium and mTLS
• Identity-based access policies that can be revoked in real time
• Support for embedded SDKs for in-process encryption and identity
• Lightweight tunnelers for adding zero-trust to existing applications
• Programmable REST APIs for automation and network management
• Intelligent path selection through a mesh fabric for routing

OpenZiti provides three distinct deployment models to accommodate different security needs. Network Access uses edge routers for boundary security, Host Access employs tunnelers on the service host to keep services dark to the network, and Application Access embeds SDKs for the highest security level. This architecture allows the platform to secure machine-to-machine communication, IoT devices, and AI agent workflows without relying on IP allowlists or shared secrets. It is particularly useful for securing agent-to-service communication for private LLMs and MCP servers, ensuring autonomous workflows only reach authorized resources.

The platform is designed for network administrators and developers who require a self-hosted, identity-centric approach to secure connectivity across diverse and distributed environments.