#Unifi controller centos how to
#Unifi controller centos mac os x
#Unifi controller centos install
#Unifi controller centos software

rw-r-r- 1 root root 1050 Dec 31 18:04 data/unifi_ДЇollow the exact same steps in the OS X section to use openssl to convert from PEM to DER if necessary. Generating a certificate request from the UniFi controller # cd /usr/lib/unifiД¬ertificate for generated You should now have CSRs in PEM and DER format in the data/ directory: # ls -l data/unifi* On at least Ubuntu the main binaries of the controller are installed to /usr/lib/unifi/, with /usr/lib/unifi/data/ being a symlink to /var/lib/unifi/. Done! Linux (CentOS/Debian)Д«asically the exact same process on CentOS/Debian/Ubuntu, except the paths to UniFi data is different. issued by OU= CA, O=, L=Fremont, ST=California, C=US]Д¬ertificates successfuly imported. Parse r (DER, 1 certs): OU= CA, O=, L=Fremont, ST=California, C=US Use the import_cert argument to ace.jar to import both the root CA andВ host certificate: # java -jar lib/ace.jar import_cert data/unifi_r data/r You can store both of these DER files in the data/ directory. # openssl x509 -outform der -in data/unifi_ -out data/unifi_ In my case I always work with PEM certificates, so I need to convert both my newly signed certificate and root certificate: # openssl x509 -outform der -in data/wannnet-ca-current-cert.pem -out data/r If youвЂ™re running your own CA, youвЂ™ll need to convert your CAвЂ™s public root key to DER format too in order to import it. Take the CSR (whichever format you prefer) and sign it with your CA.

You should now have CSRs in PEM and DER format in the data/ directory: # ls -l data/unifi* # java -jar lib/ace.jar new_cert Fremont CA US # cd /Applications/UniFi.app/Contents/Resources/ The UniFi controller can generate a CSR for you, and itвЂ™ll keep the corresponding key in the local keystore. Generating a certificate request from the UniFi controller (This is what preserves controller data between installs.) You must be in theВ main Resources/ directory before you can work with the UniFi keystore, else the tool gets unhappy with paths and canвЂ™t find things. Users/bwann/Library/Application Support/UniFi/data. The lib/ace.jar is aВ UniFi-provided Java tool to manipulate the controller and key store.Д¬ertificate requests and the keystore is stored in the data/В subdirectory which is a symlinkВ to a userвЂ™s Library/Application Support directory,В e.g.

Java (JAR) contents of the UniFi controller are installed to /Applications/UniFi.app/Contents/Resources/. My browsers on all of my laptops and phones already trust this.

I run my own certificate authority (CA) for issuing certs for all of my devices.

I didnвЂ™t put any time into looking at importing completely new private keys into the keystore, I just signed the CSR that was generated.

YouвЂ™ll need to use the UniFi tool to generate certificate requests (CSRs).

If you have certificates in PEM (which is really BASE64/ ASCII armored DER), youвЂ™ll need to use openssl or something to convert the PEM files to DER.

The UniFi (Java) keystore expects to import certificates in DER (binary) format.

#Unifi controller centos how to

How to self sign or setting up a CA is not covered here.

You have a way to get a trusted certificate to upload.

Ideally youвЂ™ll want to script this or set up something like a Chef recipe to manage the files for you, because youвЂ™ll need to repeat this whenever the cert expires or the key gets compromised. Really both are the same procedure since UniFi uses JavaвЂ™s keystore under the hood on both platforms, the paths for files are different.

#Unifi controller centos mac os x

However you wind up with a trusted cert to import, hereвЂ™s how to do it for UniFi controllers running on Mac OS X or Linux. Unfortunately it looks like thereвЂ™s a lot of confusion on how to do this, even on UbiquitiвЂ™s help pages there are articles that are titled for UniFi but are really geared for EdgeMAX products.

#Unifi controller centos install

The way to fix this (and otherwise let your browser trust the web UI) is to install your own certificate into the UniFi controller key store, either buy one from a commercial CA or your own organizationвЂ™s CA that your browsers trust.

#Unifi controller centos software

It turns out because the UniFi controller software ships out of the box with a self-signed SSL/TLS cert thatвЂ™s untrusted, Chrome does a smart thing and wonвЂ™t prompt you to save the password for the page. For the longest time I wondered why Chrome would never save the password of my Ubiquiti UniFi controllersвЂ™ web interfaces.