I have achieved PARTIAL SUCCESS in installing Godaddy SSL Certificate in UniFi Cloud Key Gen 2 Plus

Subject: I have achieved PARTIAL SUCCESS in installing Godaddy SSL Certificate in UniFi Cloud Key Gen 2 Plus

Good day from Singapore,

I am posting here because UniFi Cloud Key Gen 2 Plus is powered by Debian GNU/Linux 9.

I have found many reference guides on installing SSL certificate in UniFi Cloud Key. Please refer to the following list.

[1] How to install a SSL Certificate on Unifi Cloud Key

Link: https://community.ui.com/questions/How-to-install-a-SSL-Certificate-on-Unifi-Cloud-Key/944dbbd6-cbf6-4112-bff5-6b992fcbf2c4#:~:text=Rename%20your%20purchased%20SSL%20certificate,Upload%20to%20Cloud%20Key%E2%80%9D%20folder.&text=Before%20we%20restart%20our%20Cloud,your%20SSL%20certificate%20is%20installed

[2] How to install an SSL Certificate on Unifi Cloud Key?

Link: https://www.ssldragon.com/blog/install-ssl-certificate-on-unifi-cloud-key/

[3] Protect the UniFi Cloud Key with a custom SSL certificate

Link: https://clemens.ms/protect-the-unifi-cloud-key-with-a-custom-ssl-certificate/

[4] Deploy dehydrated generated certificate to Unifi controller

Link: https://gist.github.com/jrotello/18ab3e1982d46b04a269dfbc63aa097f

[5] How to quickly setup SSL certificate on Unifi Cloud Key

Link: https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63

[6] Unable to import the certificate into keystore

Link: https://community.ui.com/questions/Unable-to-import-the-certificate-into-keystore/c9a42223-1d36-40bf-954a-059508d52263

However, only 2 reference guides worked for me. They are:

[A] How to quickly setup SSL certificate on Unifi Cloud Key (Java method)

Link: https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63

[B] Unable to import the certificate into keystore

Link: https://community.ui.com/questions/Unable-to-import-the-certificate-into-keystore/c9a42223-1d36-40bf-954a-059508d52263

I shall detail my attempts at following the instructions below. It is not possible to install SSL certificate in the UniFi Cloud Key using Web GUI at all. The only way to do it is through the Command Line Interface (CLI). There is no other way out.

1st Attempt FAILED - following the guide at https://www.ssldragon.com/blog/install-ssl-certificate-on-unifi-cloud-key/

======================================================================================================================

openssl genrsa -out /etc/ssl/private/cloudkey.key 2048

openssl req -new -batch \

-subj "/C=SG/ST=Singapore/L=Singapore

/O=Teo-En-Ming-Corporation/OU=IT/CN=cloudkey.teo-en-ming-corp.com

/emailAddress=ceo@teo-en-ming-corp.com" \

-key /etc/ssl/private/cloudkey.key \

-out /etc/ssl/private/cloudkey.csr

Upload the primary SSL certificate cloudkey.crt to /root

cp /root/cloudkey.crt /etc/ssl/private/

openssl pkcs12 -export -in /etc/ssl/private/cloudkey.crt -inkey /etc/ssl/private/cloudkey.key -out /etc/ssl/private/cloudkey.p12 -name unifi -password pass:temppass

keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /usr/lib/unifi/data/keystore -srckeystore /etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi

Importing keystore /etc/ssl/private/cloudkey.p12 to /usr/lib/unifi/data/keystore...

Existing entry alias unifi exists, overwrite? [no]: yes

Warning:

The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /usr/lib/unifi/data/keystore -destkeystore /usr/lib/unifi/data/keystore -deststoretype pkcs12".

keytool -importkeystore -deststorepass temppass -destkeypass temppass -destkeystore /usr/lib/unifi/data/keystore -srckeystore /etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi

Importing keystore /etc/ssl/private/cloudkey.p12 to /usr/lib/unifi/data/keystore...

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

mkdir /root/backup

mv cloudkey.csr /root/backup/

mv cloudkey.p12 /root/backup/

tar -cvf cert.tar *

chown root:ssl-cert /etc/ssl/private/*

chmod 640 /etc/ssl/private/*

apt-get install nano

cp /etc/default/unifi /root/backup/

nano /etc/default/unifi

UNIFI_SSL_KEYSTORE=/etc/ssl/private/unifi.keystore.jks

cd /etc/ssl/private

cp cloudkey.crt /usr/lib/unifi/

cd /root

cp gd_bundle-g2-g1.crt /usr/lib/unifi/

cd /usr/lib/unifi

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert cloudkey.crt gd_bundle-g2-g1.crt

Unable to import the certificate into keystore

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert cloudkey.crt

Unable to import the certificate into keystore

cd /root/backup/

cp cloudkey.p12 /usr/lib/unifi

cd /usr/lib/unifi

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert cloudkey.p12

Unable to import the certificate into keystore

cp /usr/lib/unifi/data/keystore /root/backup/

rm /usr/lib/unifi/data/keystore

cd /usr/lib/unifi

2nd Attempt FAILED - following the guide at https://gist.github.com/jrotello/18ab3e1982d46b04a269dfbc63aa097f

==============================================================================================================

cd /root

cp cloudkey.pem /etc/ssl/private/

openssl pkcs12 \

-export \

-inkey /etc/ssl/private/cloudkey.key \

-in /etc/ssl/private/cloudkey.crt \

-out /etc/ssl/private/cloudkey.p12 \

-name unifi -password pass:temppass

keytool \

-importkeystore \

-deststorepass aircontrolenterprise \

-destkeypass aircontrolenterprise \

-destkeystore /etc/ssl/private/unifi.keystore.jks \

-srckeystore /etc/ssl/private/cloudkey.p12 \

-srcstoretype PKCS12 \

-srcstorepass temppass \

-alias unifi

Importing keystore /etc/ssl/private/cloudkey.p12 to /etc/ssl/private/unifi.keystore.jks...

Warning:

The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /etc/ssl/private/unifi.keystore.jks -destkeystore /etc/ssl/private/unifi.keystore.jks -deststoretype pkcs12".

cd /etc/ssl/private/

cp cloudkey.pem cloudkey.crt

tar -cf cert.tar cloudkey.crt cloudkey.key unifi.keystore.jks

cp /root/backup/unifi /etc/default/unifi

UNIFI_SSL_KEYSTORE=/etc/ssl/private/unifi.keystore.jks

root@Teo-En-Ming-Corporation:/srv/unifi/logs# grep -i cert server.log

[2022-10-25T13:29:06,654] <launcher> ERROR system - Unable to parse cert gd_bundle-g2-g1.crt

[2022-10-25T13:29:06,683] <launcher> ERROR system - Unable to parse cert cloudkey.crt

[2022-10-25T13:29:06,687] <launcher> ERROR system - Unable to import the signed certficate

[2022-10-25T13:29:35,267] <launcher> ERROR system - Unable to parse cert cloudkey.crt

[2022-10-25T13:29:35,302] <launcher> ERROR system - Unable to import the signed certficate

[2022-10-25T13:31:42,830] <launcher> ERROR system - Unable to parse cert cloudkey.p12

java.security.cert.CertificateParsingException: signed fields invalid

at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842) ~[?:1.8.0_332]

at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195) ~[?:1.8.0_332]

at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102) ~[?:1.8.0_332]

at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339) ~[?:1.8.0_332]

[2022-10-25T13:31:42,867] <launcher> ERROR system - Unable to import the signed certficate

[2022-10-25T13:34:58,933] <launcher> ERROR system - Unable to import the signed certficate

[2022-10-25T14:12:57,061] <launcher> INFO system - Generating Certificate[UniFi]... please wait...

[2022-10-25T14:12:58,665] <launcher> INFO system - Certificate[UniFi] generated!

3rd Attempt - JAVA method - following the guide at https://community.ui.com/questions/How-to-quickly-setup-SSL-certificate-on-Unifi-Cloud-Key/d991c17f-d7e0-4778-be83-f2a91c47bc63

===================================================================================================================================================================================

java -jar lib/ace.jar new_cert cloudkey.teo-en-ming-corp.com Teo-En-Ming-Corporation Singapore Singapore SG

java -jar lib/ace.jar import_cert <signed_cert> <intermediate_root_cert1> <intermediate_root_cert2> <intermediate_root_cert3>

root@Teo-En-Ming-Corporation:/usr/lib/unifi# java -jar lib/ace.jar import_cert 94d3a5414bcb5742.crt 94d3a5414bcb5742.pem gd_bundle-g2-g1.crt

Unable to import the certificate into keystore

root@Teo-En-Ming-Corporation:/usr/lib/unifi/logs# grep -i cert server.log