I thought I knew it all about certificates, but then I was humbled once again.<\/p>\n
I needed to “secure” an internal linux webserver using our Windows 2016 CA as to remove the “this is an unverified site” messages that liked to pop up when browsing the various sites.<\/p>\n
The process I had done in the past was to create the CSR using openssl, then copy the encryption data, open up my trusty http:\/\/certserverhere\/certsrv\/ site and go through the process of making a webserver certificate. Then, when finished, just download the certificate and the CA + chain, import on linux, and profit.<\/p>\n
Well, the new versions of the templates (V3 and V4 specifically) no longer allowed the web enrollment using my trusty http:\/\/certserverhere\/certsrv site. Booo.<\/p>\n
I could probably get it to work by just requesting my own certificates using the MMC, but I’m still leaning towards the whole CLI phase of life. I should also note that I find the performance and management of Unifi on Linux to be significantly better and easier than that on Windows. YMMV.<\/p>\n
By the way, this is technically how I published a certificate on our Unifi wireless controller. The CA Certificate Authority is a 2016 Windows Server that’s been published in AD. The unifi machine is running Ubuntu 17.10 and unifi version 5.6.29. I also used WinSCP, Putty, and my base machine is Win10 (not super applicable).<\/p>\n
SSH to the Unifi Machine<\/strong> Get the PEM over to your CA Server<\/strong> Certreq<\/strong> Save the Certificate<\/strong> Copy it back to Unifi<\/strong> Final Touches<\/strong> Close your browser and open back up to https:\/\/unifi:8443 and no more error!<\/p>\n","protected":false},"excerpt":{"rendered":" I thought I knew it all about certificates, but then I was humbled once again. I needed to “secure” an internal linux webserver using our Windows 2016 CA as to remove the “this is an unverified site” messages that liked to pop up when browsing the various sites. The process I had done in the … Continue reading Unifi Linux and Windows Certificates<\/span>
\n(I did this as root, so add “sudo” before commands if you’re not the root god)
\ncd \/usr\/lib\/unifi<\/code>
\njava -jar lib\/ace.jar new_cert unifi.domain.tld CompanyName Town State Country<\/code>
\nThis creates unifi_certificate.csr.der and unifi_certificate.csr.pem – the DER is encrypted and the PEM is what we need.<\/p>\n
\nI just used nano to view all the data and then copy pasted, but feel free to WinSCP it over as well
\nnano unifi_certificate.csr.pem<\/code>
\nCopy this text, then on the CA create a new text file and paste the data there. Save.<\/p>\n
\nOpen an administrative Command Prompt on your CA server
\ncertreq -submit -attrib \"SAN:dns=unifi.yourdomain.tld&dns=unifi\" -attrib \"CertificateTemplate:WebServer2018\" unifi_certificate.csr.pem<\/code>
\nBy default your Certificate Template will be “WebServer” instead of the one I listed above – I created my own template with the year it’s valid for the sake of record keeping.<\/p>\n
\nAssuming the request went through, you’ll be able to name and save your signed certificate. In my case I named it unifi_withSAN.domain.tld.cer. I also navigated to the http:\/\/certserverhere\/certsrv site and downloaded the CA certificate, Certificate chain, or CRL (I just downloaded the CA Certificate as it’s a single host with no subs).<\/p>\n
\nI used WinSCP to copy both the signed certificate as well as the CA Certificate I downloaded back to my \/home directory on the Unifi server.<\/p>\n
\nBack on your Unifi SSH session (in the \/usr\/lib\/unifi directory)
\njava -jar lib\/ace.jar import_cert \/home\/unifi_withSAN.domain.local.cer \/home\/srv-cert01-ca.cer<\/code>
\nReplace srv-cert01-ca with the name of your CA certificate.
\nIf successful, restart the unifi services
\nservice unifi restart<\/code><\/p>\n