I have achieved PARTIAL SUCCESS in installing Godaddy SSL Certificate in UniFi Cloud Key Gen 2 Plus

Subject: I have achieved PARTIAL SUCCESS in installing Godaddy SSL Certificate in UniFi Cloud Key Gen 2 Plus

Good day from Singapore,

I am posting here because UniFi Cloud Key Gen 2 Plus is powered by Debian GNU/Linux 9.

I have found many reference guides on installing SSL certificate in UniFi Cloud Key. Please refer to the following list.

[1] How to install a SSL Certificate on Unifi Cloud Key

Link: https://community.ui.com/questions/How-to-install-a-SSL-Certificate-on-Unifi-Cloud-Key/944dbbd6-cbf6-4112-bff5-6b992fcbf2c4#:~:text=Rename%20your%20purchased%20SSL%20certificate,Upload%20to%20Cloud%20Key%E2%80%9D%20folder.&text=Before%20we%20restart%20our%20Cloud,your%20SSL%20certificate%20is%20installed

[2] How to install an SSL Certificate on Unifi Cloud Key?

Link: https://www.ssldragon.com/blog/install-ssl-certificate-on-unifi-cloud-key/

[3] Protect the UniFi Cloud Key with a custom SSL certificate

Link: https://clemens.ms/protect-the-unifi-cloud-key-with-a-custom-ssl-certificate/

[4] Deploy dehydrated generated certificate to Unifi controller

Link: https://gist.github.com/jrotello/18ab3e1982d46b04a269dfbc63aa097f

[5] How to quickly setup SSL certificate on Unifi Cloud Key

Link: https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63

[6] Unable to import the certificate into keystore

Link: https://community.ui.com/questions/Unable-to-import-the-certificate-into-keystore/c9a42223-1d36-40bf-954a-059508d52263

However, only 2 reference guides worked for me. They are:

[A] How to quickly setup SSL certificate on Unifi Cloud Key (Java method)

Link: https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63

[B] Unable to import the certificate into keystore

Link: https://community.ui.com/questions/Unable-to-import-the-certificate-into-keystore/c9a42223-1d36-40bf-954a-059508d52263

I shall detail my attempts at following the instructions below. It is not possible to install SSL certificate in the UniFi Cloud Key using Web GUI at all. The only way to do it is through the Command Line Interface (CLI). There is no other way out.

1st Attempt FAILED - following the guide at https://www.ssldragon.com/blog/install-ssl-certificate-on-unifi-cloud-key/
======================================================================================================================

openssl genrsa -out /etc/ssl/private/cloudkey.key 2048

openssl req -new -batch \
-subj "/C=SG/ST=Singapore/L=Singapore
/O=Teo-En-Ming-Corporation/OU=IT/CN=cloudkey.teo-en-ming-corp.com
/emailAddress=ceo@teo-en-ming-corp.com" \
-key /etc/ssl/private/cloudkey.key \
-out /etc/ssl/private/cloudkey.csr

Upload the primary SSL certificate cloudkey.crt to /root

cp /root/cloudkey.crt /etc/ssl/private/

openssl pkcs12 -export -in /etc/ssl/private/cloudkey.crt -inkey /etc/ssl/private/cloudkey.key -out /etc/ssl/private/cloudkey.p12 -name unifi -password pass:temppass

keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /usr/lib/unifi/data/keystore -srckeystore /etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi

Importing keystore /etc/ssl/private/cloudkey.p12 to /usr/lib/unifi/data/keystore...
Existing entry alias unifi exists, overwrite? [no]: yes

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /usr/lib/unifi/data/keystore -destkeystore /usr/lib/unifi/data/keystore -deststoretype pkcs12".

keytool -importkeystore -deststorepass temppass -destkeypass temppass -destkeystore /usr/lib/unifi/data/keystore -srckeystore /etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi
Importing keystore /etc/ssl/private/cloudkey.p12 to /usr/lib/unifi/data/keystore...
keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

mkdir /root/backup

mv cloudkey.csr /root/backup/

mv cloudkey.p12 /root/backup/

tar -cvf cert.tar *

chown root:ssl-cert /etc/ssl/private/*

chmod 640 /etc/ssl/private/*

apt-get install nano

cp /etc/default/unifi /root/backup/

nano /etc/default/unifi

UNIFI_SSL_KEYSTORE=/etc/ssl/private/unifi.keystore.jks

cd /etc/ssl/private

cp cloudkey.crt /usr/lib/unifi/

cd /root

cp gd_bundle-g2-g1.crt /usr/lib/unifi/

cd /usr/lib/unifi

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert cloudkey.crt gd_bundle-g2-g1.crt
Unable to import the certificate into keystore
root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert cloudkey.crt
Unable to import the certificate into keystore

cd /root/backup/

cp cloudkey.p12 /usr/lib/unifi

cd /usr/lib/unifi

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert cloudkey.p12
Unable to import the certificate into keystore

cp /usr/lib/unifi/data/keystore /root/backup/

rm /usr/lib/unifi/data/keystore

cd /usr/lib/unifi

2nd Attempt FAILED - following the guide at https://gist.github.com/jrotello/18ab3e1982d46b04a269dfbc63aa097f
==============================================================================================================

cd /root

cp cloudkey.pem /etc/ssl/private/

openssl pkcs12 \
-export \
-inkey /etc/ssl/private/cloudkey.key \
-in /etc/ssl/private/cloudkey.crt \
-out /etc/ssl/private/cloudkey.p12 \
-name unifi -password pass:temppass

keytool \
-importkeystore \
-deststorepass aircontrolenterprise \
-destkeypass aircontrolenterprise \
-destkeystore /etc/ssl/private/unifi.keystore.jks \
-srckeystore /etc/ssl/private/cloudkey.p12 \
-srcstoretype PKCS12 \
-srcstorepass temppass \
-alias unifi

Importing keystore /etc/ssl/private/cloudkey.p12 to /etc/ssl/private/unifi.keystore.jks...

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /etc/ssl/private/unifi.keystore.jks -destkeystore /etc/ssl/private/unifi.keystore.jks -deststoretype pkcs12".

cd /etc/ssl/private/

cp cloudkey.pem cloudkey.crt

tar -cf cert.tar cloudkey.crt cloudkey.key unifi.keystore.jks

cp /root/backup/unifi /etc/default/unifi

UNIFI_SSL_KEYSTORE=/etc/ssl/private/unifi.keystore.jks

root@Teo-En-Ming-Corporation:/srv/unifi/logs# grep -i cert server.log
[2022-10-25T13:29:06,654] <launcher> ERROR system - Unable to parse cert gd_bundle-g2-g1.crt
[2022-10-25T13:29:06,683] <launcher> ERROR system - Unable to parse cert cloudkey.crt
[2022-10-25T13:29:06,687] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:29:35,267] <launcher> ERROR system - Unable to parse cert cloudkey.crt
[2022-10-25T13:29:35,302] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:31:42,830] <launcher> ERROR system - Unable to parse cert cloudkey.p12
java.security.cert.CertificateParsingException: signed fields invalid
at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842) ~[?:1.8.0_332]
at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195) ~[?:1.8.0_332]
at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102) ~[?:1.8.0_332]
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339) ~[?:1.8.0_332]
[2022-10-25T13:31:42,867] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:34:58,933] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T14:12:57,061] <launcher> INFO system - Generating Certificate[UniFi]... please wait...
[2022-10-25T14:12:58,665] <launcher> INFO system - Certificate[UniFi] generated!

3rd Attempt - JAVA method - following the guide at https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63
===================================================================================================================================================================================

java -jar lib/ace.jar new_cert cloudkey.teo-en-ming-corp.com Teo-En-Ming-Corporation Singapore Singapore SG

java -jar lib/ace.jar import_cert <signed_cert> <intermediate_root_cert1> <intermediate_root_cert2> <intermediate_root_cert3>

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert 94d3a5414bcb5742.crt 94d3a5414bcb5742.pem gd_bundle-g2-g1.crt
Unable to import the certificate into keystore

root@Teo-En-Ming-Corporation:/usr/lib/unifi/logs# grep -i cert server.log
[2022-10-25T13:29:06,654] <launcher> ERROR system - Unable to parse cert gd_bundle-g2-g1.crt
[2022-10-25T13:29:06,683] <launcher> ERROR system - Unable to parse cert cloudkey.crt
[2022-10-25T13:29:06,687] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:29:35,267] <launcher> ERROR system - Unable to parse cert cloudkey.crt
[2022-10-25T13:29:35,302] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:31:42,830] <launcher> ERROR system - Unable to parse cert cloudkey.p12
java.security.cert.CertificateParsingException: signed fields invalid
at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842) ~[?:1.8.0_332]
at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195) ~[?:1.8.0_332]
at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102) ~[?:1.8.0_332]
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339) ~[?:1.8.0_332]
[2022-10-25T13:31:42,867] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:34:58,933] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T14:12:57,061] <launcher> INFO system - Generating Certificate[UniFi]... please wait...
[2022-10-25T14:12:58,665] <launcher> INFO system - Certificate[UniFi] generated!
[2022-10-25T15:09:17,326] <launcher> INFO system - Generating Certificate[cloudkey.teo-en-ming-corp.com]... please wait...
[2022-10-25T15:09:18,596] <launcher> INFO system - Certificate[cloudkey.teo-en-ming-corp.com] generated!
[2022-10-25T15:17:54,306] <launcher> ERROR system - Unable to parse cert 94d3a5414bcb5742.pem
[2022-10-25T15:17:54,332] <launcher> ERROR system - Unable to parse cert gd_bundle-g2-g1.crt
[2022-10-25T15:17:54,336] <launcher> ERROR system - Unable to parse cert 94d3a5414bcb5742.crt
[2022-10-25T15:17:54,339] <launcher> ERROR system - Unable to import the signed certficate
root@Teo-En-Ming-Corporation:/usr/lib/unifi/logs#

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert 94d3a5414bcb5742.crt
Unable to import the certificate into keystore
root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert 94d3a5414bcb5742.pem
Unable to import the certificate into keystore
root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert gd_bundle-g2-g1.crt
Unable to import the certificate into keystore

root@Teo-En-Ming-Corporation:/usr/lib/unifi/logs# grep -i cert server.log
[2022-10-25T13:29:06,654] <launcher> ERROR system - Unable to parse cert gd_bundle-g2-g1.crt
[2022-10-25T13:29:06,683] <launcher> ERROR system - Unable to parse cert cloudkey.crt
[2022-10-25T13:29:06,687] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:29:35,267] <launcher> ERROR system - Unable to parse cert cloudkey.crt
[2022-10-25T13:29:35,302] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:31:42,830] <launcher> ERROR system - Unable to parse cert cloudkey.p12
java.security.cert.CertificateParsingException: signed fields invalid
at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842) ~[?:1.8.0_332]
at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195) ~[?:1.8.0_332]
at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102) ~[?:1.8.0_332]
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339) ~[?:1.8.0_332]
[2022-10-25T13:31:42,867] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T13:34:58,933] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T14:12:57,061] <launcher> INFO system - Generating Certificate[UniFi]... please wait...
[2022-10-25T14:12:58,665] <launcher> INFO system - Certificate[UniFi] generated!
[2022-10-25T15:09:17,326] <launcher> INFO system - Generating Certificate[cloudkey.teo-en-ming-corp.com]... please wait...
[2022-10-25T15:09:18,596] <launcher> INFO system - Certificate[cloudkey.teo-en-ming-corp.com] generated!
[2022-10-25T15:17:54,306] <launcher> ERROR system - Unable to parse cert 94d3a5414bcb5742.pem
[2022-10-25T15:17:54,332] <launcher> ERROR system - Unable to parse cert gd_bundle-g2-g1.crt
[2022-10-25T15:17:54,336] <launcher> ERROR system - Unable to parse cert 94d3a5414bcb5742.crt
[2022-10-25T15:17:54,339] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T15:20:15,236] <launcher> ERROR system - Unable to parse cert 94d3a5414bcb5742.crt
[2022-10-25T15:20:15,264] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T15:20:45,584] <launcher> ERROR system - Unable to parse cert 94d3a5414bcb5742.pem
[2022-10-25T15:20:45,612] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T15:21:08,616] <launcher> ERROR system - Unable to parse cert gd_bundle-g2-g1.crt
[2022-10-25T15:21:08,649] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T15:24:38,437] <launcher> ERROR system - Unable to parse cert 94d3a5414bcb5742.crt
[2022-10-25T15:24:38,463] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T15:25:33,473] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T15:25:54,484] <launcher> ERROR system - Unable to import the signed certficate
[2022-10-25T15:26:15,505] <launcher> ERROR system - Unable to import the signed certficate

4th and FINAL ATTEMPT - SUCCESS (using Java method)
=====================================================

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert 94d3a5414bcb5742.crt gd_bundle-g2-g1.crt
parse gd_bundle-g2-g1.crt (PEM, 3 certs):
found [Go Daddy Secure Certificate Authority - G2]
found [Go Daddy Root Certificate Authority - G2]
found [OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US]
parse 94d3a5414bcb5742.crt (PEM, 1 certs): cloudkey.teo-en-ming-corp.com
Importing signed cert[cloudkey.teo-en-ming-corp.com]
... issued by [Go Daddy Secure Certificate Authority - G2]
... issued by [Go Daddy Root Certificate Authority - G2]
... issued by [OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US]
Certificates successfuly imported. Please restart the UniFi Network application.

# service unifi start

Please note that our UniFi Cloud Key Gen 2 Plus is a standalone device. It is not an UniFi Controller at all.

When I say I have gotten partial success, it is because the Godaddy SSL certificate was installed for HTTPS port 8443. As you all know, 8443 is the standard port for the UniFi Controller.

Godaddy SSL certificate was NOT installed for HTTPS port 443 at all. In other words, the Godaddy SSL certificate was NOT installed for
https://cloudkey.teo-en-ming-corp.com

The Godaddy SSL certificate was installed for https://192.168.90.2:8443 instead. We can view the SSL certificate details below.

SSL Certificate details
=======================

Issued To

Common Name (CN) cloudkey.teo-en-ming-corp.com

Issued By

Common Name (CN) Go Daddy Secure Certificate Authority - G2
Organization (O) GoDaddy.com, Inc.
Organizational Unit (OU) http://certs.godaddy.com/repository

Validity Period

Issued On Tuesday, October 25, 2022 at 3:12:39 PM
Expires On Wednesday, October 25, 2023 at 3:12:39 PM

As you can see from the above certificate details, the Godaddy SSL certificate was correctly installed for https://192.168.90.2:8443

However, when we try to access https://cloudkey.teo-en-ming-corp.com:8443, it says that SSL Protocol is not supported. Something like that. I can't remember the exact error message.

I guess this happens because there is no UniFi Controller running at HTTPS port 8443. Only the standalone UniFi Cloud Key UniFi OS is running at HTTPS port 443.

Also, I guess that the correct/default location for the Java Keystore is /usr/lib/unifi/data/keystore

It should not be located at /etc/ssl/private/unifi.keystore.jks

Please advise.

Thank you very much.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Targeted Individual in Singapore
Blogs:
https://tdtemcerts.blogspot.com
https://tdtemcerts.wordpress.com