UnifiOS v4.1 - certificate locations and configuration mechanism changed

[jcgillespie]

I know it is still in early access, but wanted to give an FYI.

The deployment script is failing silently for me, for at least the frontend - I don't use RADIUS or the hotspot. No error message, but the cert is not put into use.

In doing a little digging, the yaml format and location looks different. I think the frontend certs are now controlled by /data/unifi-core/config/http/local-certs.conf
When I uploaded my certs using the Unifi UI, they were renamed to a GUID and placed in /data/unifi-core/config/ and that's what local-certs.conf I pointing at.

The format of local-certs.conf is different from the overrides too.
Rather than this it looks like this for me.

ssl_certificate     /data/unifi-core/config/<GUID>.crt;
ssl_certificate_key /data/unifi-core/config/<GUID>.key;

I tried hand-editing local-certs.conf to point to the ubios-cert location, but something is resetting it back to the previous guide cert when I restart the frontend.

Model: UniFi Dream Machine PRO
Version: 4.1.11.20727
Network App Version: 9.0.106

script output - it did

root@UDMPro:/data/ubios-cert# ./ubios-cert.sh deploy-webfrontend
# Supported firmware: 4.1.11 on UniFi Dream Machine Pro. Moving on.
# Checking for new certificate to be deployed to web frontend.
root@UDMPro:/data/ubios-cert# ./ubios-cert.sh deploy
# Supported firmware: 4.1.11 on UniFi Dream Machine Pro. Moving on.
# Deploying certificates and restarting UniFi OS
# Checking for new certificate to be deployed to web frontend.

[alxwolf]

Thanks for pointing this out. I stopped running EA firmwares - reasons...

As containment action, the deploy.sh script now checks if the firmware version is 4.1 and will bail out.

I'm a bit on the edge here. I'm getting bored chasing undocumented changes by UI. Maybe I will change the whole approach and just grab certificates via Let's Encrypt and feed them to Glenn's script. Let's see what the Christmas break brings.

[jcgillespie]

I appreciate the work you've put in. I can imagine how frustrating that would be If it helps, I just noticed that the GlennR scripts now support DNS challenges.

[alxwolf]

Yep that's true but GlennR removed most of DNS providers on UI hardware only. So the provider I need is not supported.

I'm a hobbyist so I just might live with it.

Merry Christmas, by the way!

[ther3zz]

looks like unifi os 4.1.13 is out of EA btw

Merry Christmas and Happy New Year!

[alxwolf]

Installed 4.1.13 on my UDM, ran 'ubios-cert force-renew' and it worked for the web frontend.