Skip to content

Unifi Controller

Jump to bottom
Kenley Cheung edited this page Aug 5, 2018 · 3 revisions

Basic information

  • Hosted on Digital ocean
  • Domain is unifi-controller.
  • Server certificate is from Let's Encrypt.

Certificates

Install Certbot client for Let's Encrypt

Instructions: https://certbot.eff.org/lets-encrypt/debianjessie-other

apt-get install certbot

root@unifi-controller:~# certbot certonly
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?
-------------------------------------------------------------------------------
1: Place files in webroot directory (webroot)
2: Spin up a temporary webserver (standalone)
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): <REDACTED EMAIL>

-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel: A
Please enter in your domain name(s) (comma and/or space separated)  (Enter 'c'
to cancel): <DOMAIN NAME REDACTED>
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for <DOMAIN NAME REDACTED>
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/<DOMAIN NAME REDACTED>/fullchain.pem.
   Your cert will expire on 2018-11-03. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you lose your account credentials, you can recover through
   e-mails sent to <REDACTED EMAIL>.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

root@unifi-controller:~#

Inserting Let's Encrypt certificate into Unifi keystore

  • Download intermediate certificates ** isrgrootx1.pem ** letsencryptauthorityx3.pem

  • cd /usr/lib/unifi/

  • `java -jar lib/ace.jar import_cert /etc/letsencrypt/live//fullchain.pem /root/letsencryptauthorityx3.pem /root/isrgrootx1.pem /etc/letsencrypt/keys/0000_key-certbot.pem

  • openssl pkcs12 -export -in /etc/letsencrypt/live/<DOMAIN NAME REDACTED>/cert.pem -inkey /etc/letsencrypt/keys/0000_key-certbot.pem -chain -CAfile /etc/letsencrypt/live/<DOMAIN NAME REDACTED>/chain.pem -name "<DOMAIN NAME REDACTED>" -out cert.p12

  • keytool -importkeystore -srckeystore cert.p12 -srcstoretype PKCS12 -srcstorepass test -destkeystore keystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -alias <DOMAIN NAME REDACTED> -destalias unifi -trustcacerts

Clone this wiki locally