I have achieved PARTIAL SUCCESS in installing Godaddy SSL Certificate in UniFi Cloud Key Gen 2 Plus

Turritopsis Dohrnii Teo En Ming tdtemccnp at gmail.com
Tue Oct 25 14:00:32 UTC 2022


Subject: I have achieved PARTIAL SUCCESS in installing Godaddy SSL
Certificate in UniFi Cloud Key Gen 2 Plus

Good day from Singapore,

I am posting here because UniFi Cloud Key Gen 2 Plus is powered by Debian
GNU/Linux 9.

I have found many reference guides on installing SSL certificate in UniFi
Cloud Key. Please refer to the following list.

[1] How to install a SSL Certificate on Unifi Cloud Key

Link:
https://community.ui.com/questions/How-to-install-a-SSL-Certificate-on-Unifi-Cloud-Key/944dbbd6-cbf6-4112-bff5-6b992fcbf2c4#:~:text=Rename%20your%20purchased%20SSL%20certificate,Upload%20to%20Cloud%20Key%E2%80%9D%20folder.&text=Before%20we%20restart%20our%20Cloud,your%20SSL%20certificate%20is%20installed

[2] How to install an SSL Certificate on Unifi Cloud Key?

Link:
https://www.ssldragon.com/blog/install-ssl-certificate-on-unifi-cloud-key/

[3] Protect the UniFi Cloud Key with a custom SSL certificate

Link:
https://clemens.ms/protect-the-unifi-cloud-key-with-a-custom-ssl-certificate/

[4] Deploy dehydrated generated certificate to Unifi controller

Link: https://gist.github.com/jrotello/18ab3e1982d46b04a269dfbc63aa097f

[5] How to quickly setup SSL certificate on Unifi Cloud Key

Link:
https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63

[6] Unable to import the certificate into keystore

Link:
https://community.ui.com/questions/Unable-to-import-the-certificate-into-keystore/c9a42223-1d36-40bf-954a-059508d52263

However, only 2 reference guides worked for me. They are:

[A] How to quickly setup SSL certificate on Unifi Cloud Key (Java method)

Link:
https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63

[B] Unable to import the certificate into keystore

Link:
https://community.ui.com/questions/Unable-to-import-the-certificate-into-keystore/c9a42223-1d36-40bf-954a-059508d52263

I shall detail my attempts at following the instructions below. It is not
possible to install SSL certificate in the UniFi Cloud Key using Web GUI at
all. The only way to do it is through the Command Line Interface (CLI).
There is no other way out.

1st Attempt FAILED - following the guide at
https://www.ssldragon.com/blog/install-ssl-certificate-on-unifi-cloud-key/
======================================================================================================================

openssl genrsa -out /etc/ssl/private/cloudkey.key 2048

openssl req -new -batch \
-subj "/C=SG/ST=Singapore/L=Singapore
/O=Teo-En-Ming-Corporation/OU=IT/CN=cloudkey.teo-en-ming-corp.com
/emailAddress=ceo at teo-en-ming-corp.com" \
-key /etc/ssl/private/cloudkey.key \
-out /etc/ssl/private/cloudkey.csr

Upload the primary SSL certificate cloudkey.crt to /root

cp /root/cloudkey.crt /etc/ssl/private/

openssl pkcs12 -export -in /etc/ssl/private/cloudkey.crt -inkey
/etc/ssl/private/cloudkey.key -out /etc/ssl/private/cloudkey.p12 -name
unifi -password pass:temppass

keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass
aircontrolenterprise -destkeystore /usr/lib/unifi/data/keystore
-srckeystore /etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12
-srcstorepass temppass -alias unifi

Importing keystore /etc/ssl/private/cloudkey.p12 to
/usr/lib/unifi/data/keystore...
Existing entry alias unifi exists, overwrite? [no]:  yes

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to
PKCS12 which is an industry standard format using "keytool -importkeystore
-srckeystore /usr/lib/unifi/data/keystore -destkeystore
/usr/lib/unifi/data/keystore -deststoretype pkcs12".

keytool -importkeystore -deststorepass temppass -destkeypass temppass
-destkeystore /usr/lib/unifi/data/keystore -srckeystore
/etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12 -srcstorepass temppass
-alias unifi
Importing keystore /etc/ssl/private/cloudkey.p12 to
/usr/lib/unifi/data/keystore...
keytool error: java.io.IOException: Keystore was tampered with, or password
was incorrect

mkdir /root/backup

mv cloudkey.csr /root/backup/

mv cloudkey.p12 /root/backup/

tar -cvf cert.tar *

chown root:ssl-cert /etc/ssl/private/*

chmod 640 /etc/ssl/private/*

apt-get install nano

cp /etc/default/unifi /root/backup/

nano /etc/default/unifi

UNIFI_SSL_KEYSTORE=/etc/ssl/private/unifi.keystore.jks

cd /etc/ssl/private

cp cloudkey.crt /usr/lib/unifi/

cd /root

cp gd_bundle-g2-g1.crt /usr/lib/unifi/

cd /usr/lib/unifi

root at Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar
import_cert cloudkey.crt gd_bundle-g2-g1.crt
Unable to import the certificate into keystore
root at Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar
import_cert cloudkey.crt
Unable to import the certificate into keystore

cd /root/backup/

cp cloudkey.p12 /usr/lib/unifi

cd /usr/lib/unifi

root at Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar
import_cert cloudkey.p12
Unable to import the certificate into keystore

cp /usr/lib/unifi/data/keystore /root/backup/

rm /usr/lib/unifi/data/keystore

cd /usr/lib/unifi


2nd Attempt FAILED - following the guide at
https://gist.github.com/jrotello/18ab3e1982d46b04a269dfbc63aa097f
==============================================================================================================

cd /root

cp cloudkey.pem /etc/ssl/private/

openssl pkcs12 \
-export \
-inkey /etc/ssl/private/cloudkey.key \
-in /etc/ssl/private/cloudkey.crt \
-out /etc/ssl/private/cloudkey.p12 \
-name unifi -password pass:temppass

keytool \
-importkeystore \
-deststorepass aircontrolenterprise \
-destkeypass aircontrolenterprise \
-destkeystore /etc/ssl/private/unifi.keystore.jks \
-srckeystore /etc/ssl/private/cloudkey.p12 \
-srcstoretype PKCS12 \
-srcstorepass temppass \
-alias unifi

Importing keystore /etc/ssl/private/cloudkey.p12 to
/etc/ssl/private/unifi.keystore.jks...

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to
PKCS12 which is an industry standard format using "keytool -importkeystore
-srckeystore /etc/ssl/private/unifi.keystore.jks -destkeystore
/etc/ssl/private/unifi.keystore.jks -deststoretype pkcs12".

cd /etc/ssl/private/

cp cloudkey.pem cloudkey.crt

tar -cf cert.tar cloudkey.crt cloudkey.key unifi.keystore.jks

cp /root/backup/unifi /etc/default/unifi

UNIFI_SSL_KEYSTORE=/etc/ssl/private/unifi.keystore.jks

root at Teo-En-Ming-Corporation:/srv/unifi/logs# grep -i cert server.log
[2022-10-25T13:29:06,654] <launcher> ERROR system - Unable to parse cert
gd_bundle-g2-g1.crt
[2022-10-25T13:29:06,683] <launcher> ERROR system - Unable to parse cert
cloudkey.crt
[2022-10-25T13:29:06,687] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:29:35,267] <launcher> ERROR system - Unable to parse cert
cloudkey.crt
[2022-10-25T13:29:35,302] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:31:42,830] <launcher> ERROR system - Unable to parse cert
cloudkey.p12
java.security.cert.CertificateParsingException: signed fields invalid
        at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842)
~[?:1.8.0_332]
        at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
~[?:1.8.0_332]
        at
sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102)
~[?:1.8.0_332]
        at
java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
~[?:1.8.0_332]
[2022-10-25T13:31:42,867] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:34:58,933] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T14:12:57,061] <launcher> INFO  system - Generating
Certificate[UniFi]... please wait...
[2022-10-25T14:12:58,665] <launcher> INFO  system - Certificate[UniFi]
generated!


3rd Attempt - JAVA method - following the guide at
https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63
===================================================================================================================================================================================

java -jar lib/ace.jar new_cert cloudkey.teo-en-ming-corp.com
Teo-En-Ming-Corporation Singapore Singapore SG

java -jar lib/ace.jar import_cert <signed_cert> <intermediate_root_cert1>
<intermediate_root_cert2> <intermediate_root_cert3>

root at Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar
import_cert 94d3a5414bcb5742.crt 94d3a5414bcb5742.pem gd_bundle-g2-g1.crt
Unable to import the certificate into keystore

root at Teo-En-Ming-Corporation:/usr/lib/unifi/logs# grep -i cert server.log
[2022-10-25T13:29:06,654] <launcher> ERROR system - Unable to parse cert
gd_bundle-g2-g1.crt
[2022-10-25T13:29:06,683] <launcher> ERROR system - Unable to parse cert
cloudkey.crt
[2022-10-25T13:29:06,687] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:29:35,267] <launcher> ERROR system - Unable to parse cert
cloudkey.crt
[2022-10-25T13:29:35,302] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:31:42,830] <launcher> ERROR system - Unable to parse cert
cloudkey.p12
java.security.cert.CertificateParsingException: signed fields invalid
        at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842)
~[?:1.8.0_332]
        at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
~[?:1.8.0_332]
        at
sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102)
~[?:1.8.0_332]
        at
java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
~[?:1.8.0_332]
[2022-10-25T13:31:42,867] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:34:58,933] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T14:12:57,061] <launcher> INFO  system - Generating
Certificate[UniFi]... please wait...
[2022-10-25T14:12:58,665] <launcher> INFO  system - Certificate[UniFi]
generated!
[2022-10-25T15:09:17,326] <launcher> INFO  system - Generating Certificate[
cloudkey.teo-en-ming-corp.com]... please wait...
[2022-10-25T15:09:18,596] <launcher> INFO  system - Certificate[
cloudkey.teo-en-ming-corp.com] generated!
[2022-10-25T15:17:54,306] <launcher> ERROR system - Unable to parse cert
94d3a5414bcb5742.pem
[2022-10-25T15:17:54,332] <launcher> ERROR system - Unable to parse cert
gd_bundle-g2-g1.crt
[2022-10-25T15:17:54,336] <launcher> ERROR system - Unable to parse cert
94d3a5414bcb5742.crt
[2022-10-25T15:17:54,339] <launcher> ERROR system - Unable to import the
signed certficate
root at Teo-En-Ming-Corporation:/usr/lib/unifi/logs#

root at Teo-En-Ming-Corporation:/usr/lib/unifi#  java -jar lib/ace.jar
import_cert 94d3a5414bcb5742.crt
Unable to import the certificate into keystore
root at Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar
import_cert 94d3a5414bcb5742.pem
Unable to import the certificate into keystore
root at Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar
import_cert gd_bundle-g2-g1.crt
Unable to import the certificate into keystore

root at Teo-En-Ming-Corporation:/usr/lib/unifi/logs# grep -i cert server.log
[2022-10-25T13:29:06,654] <launcher> ERROR system - Unable to parse cert
gd_bundle-g2-g1.crt
[2022-10-25T13:29:06,683] <launcher> ERROR system - Unable to parse cert
cloudkey.crt
[2022-10-25T13:29:06,687] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:29:35,267] <launcher> ERROR system - Unable to parse cert
cloudkey.crt
[2022-10-25T13:29:35,302] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:31:42,830] <launcher> ERROR system - Unable to parse cert
cloudkey.p12
java.security.cert.CertificateParsingException: signed fields invalid
        at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842)
~[?:1.8.0_332]
        at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
~[?:1.8.0_332]
        at
sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102)
~[?:1.8.0_332]
        at
java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
~[?:1.8.0_332]
[2022-10-25T13:31:42,867] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T13:34:58,933] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T14:12:57,061] <launcher> INFO  system - Generating
Certificate[UniFi]... please wait...
[2022-10-25T14:12:58,665] <launcher> INFO  system - Certificate[UniFi]
generated!
[2022-10-25T15:09:17,326] <launcher> INFO  system - Generating Certificate[
cloudkey.teo-en-ming-corp.com]... please wait...
[2022-10-25T15:09:18,596] <launcher> INFO  system - Certificate[
cloudkey.teo-en-ming-corp.com] generated!
[2022-10-25T15:17:54,306] <launcher> ERROR system - Unable to parse cert
94d3a5414bcb5742.pem
[2022-10-25T15:17:54,332] <launcher> ERROR system - Unable to parse cert
gd_bundle-g2-g1.crt
[2022-10-25T15:17:54,336] <launcher> ERROR system - Unable to parse cert
94d3a5414bcb5742.crt
[2022-10-25T15:17:54,339] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T15:20:15,236] <launcher> ERROR system - Unable to parse cert
94d3a5414bcb5742.crt
[2022-10-25T15:20:15,264] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T15:20:45,584] <launcher> ERROR system - Unable to parse cert
94d3a5414bcb5742.pem
[2022-10-25T15:20:45,612] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T15:21:08,616] <launcher> ERROR system - Unable to parse cert
gd_bundle-g2-g1.crt
[2022-10-25T15:21:08,649] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T15:24:38,437] <launcher> ERROR system - Unable to parse cert
94d3a5414bcb5742.crt
[2022-10-25T15:24:38,463] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T15:25:33,473] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T15:25:54,484] <launcher> ERROR system - Unable to import the
signed certficate
[2022-10-25T15:26:15,505] <launcher> ERROR system - Unable to import the
signed certficate

4th and FINAL ATTEMPT - SUCCESS (using Java method)
=====================================================

root at Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar
import_cert 94d3a5414bcb5742.crt gd_bundle-g2-g1.crt
parse gd_bundle-g2-g1.crt (PEM, 3 certs):
    found [Go Daddy Secure Certificate Authority - G2]
    found [Go Daddy Root Certificate Authority - G2]
    found [OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy
Group, Inc.", C=US]
parse 94d3a5414bcb5742.crt (PEM, 1 certs): cloudkey.teo-en-ming-corp.com
Importing signed cert[cloudkey.teo-en-ming-corp.com]
... issued by [Go Daddy Secure Certificate Authority - G2]
... issued by [Go Daddy Root Certificate Authority - G2]
... issued by [OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy
Group, Inc.", C=US]
Certificates successfuly imported. Please restart the UniFi Network
application.

# service unifi start

Please note that our UniFi Cloud Key Gen 2 Plus is a standalone device. It
is not an UniFi Controller at all.

When I say I have gotten partial success, it is because the Godaddy SSL
certificate was installed for HTTPS port 8443. As you all know, 8443 is the
standard port for the UniFi Controller.

Godaddy SSL certificate was NOT installed for HTTPS port 443 at all. In
other words, the Godaddy SSL certificate was NOT installed for
https://cloudkey.teo-en-ming-corp.com

The Godaddy SSL certificate was installed for https://192.168.90.2:8443
instead. We can view the SSL certificate details below.

SSL Certificate details
=======================

Issued To

Common Name (CN)               cloudkey.teo-en-ming-corp.com

Issued By

Common Name (CN) Go Daddy Secure Certificate Authority - G2
Organization (O) GoDaddy.com, Inc.
Organizational Unit (OU) http://certs.godaddy.com/repository

Validity Period

Issued On Tuesday, October 25, 2022 at 3:12:39 PM
Expires On Wednesday, October 25, 2023 at 3:12:39 PM

As you can see from the above certificate details, the Godaddy SSL
certificate was correctly installed for https://192.168.90.2:8443

However, when we try to access https://cloudkey.teo-en-ming-corp.com:8443,
it says that SSL Protocol is not supported. Something like that. I can't
remember the exact error message.

I guess this happens because there is no UniFi Controller running at HTTPS
port 8443. Only the standalone UniFi Cloud Key UniFi OS is running at HTTPS
port 443.

Also, I guess that the correct/default location for the Java Keystore is
/usr/lib/unifi/data/keystore

It should not be located at /etc/ssl/private/unifi.keystore.jks

Please advise.

Thank you very much.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Targeted Individual in Singapore
Blogs:
https://tdtemcerts.blogspot.com
https://tdtemcerts.wordpress.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20221025/75cb9fc3/attachment-0001.htm>


More information about the openssl-users mailing list