Make your home smarter: ssl

Showing posts with label ssl. Show all posts

Monday, June 8, 2026

SSL wildcard certificate extension

1. Go to the email where it is requested to complete the configuration process, click on the link

2. Go into DSM > Control Panel > Security > Certificate > Right click the certificate and click on renew

3. Download the archive.zip containing the CSR (the one you need) and a private key. Open server.csr. Copy the text

4. On the website paste the CSR and go through the menu. Choose admin@domain.com to send the emails to

5. Approve the request and a new email will be send with the certificate

6. Open command line and paste the certificate into server.crt

7. Test for the issuer to find the intermediate: openssl x509 -in server.crt -text -noout | grep -E "Issuer:|CA Issuers"

Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign GCC R6 AlphaSSL CA 2025
CA Issuers - URI:http://secure.globalsign.com/cacert/gsgccr6alphasslca2025.crt

8. Download if needed: curl -O http://secure.globalsign.com/cacert/gsgccr6alphasslca2025.crt

9. Convert:

openssl x509 -inform DER -in gsgccr6alphasslca2025.crt -out intermediate_pem.crt

cat server.crt intermediate_pem.crt > fullchain.crt

10. Verify:
openssl verify -untrusted fullchain.crt server.crt

server.crt: OK

11. Install the new certificate by adding a new certificate in DSM (and choose to replace the *.domain.com)

Important:

-Use intermediate_pem.crt as intermediate, otherwise use fullchain.crt

-If needed, just install a new one and delete the old one afterwards

12. Make new certificate default one

13. Go to Dropbox and place the new files there

Update wildcard certificate on Unifi Controller as Docker container & for Plex

root@server:/volume1/docker/unifi/data# cd /usr/syno/etc/certificate/_archive

root@server:/usr/syno/etc/certificate/_archive# ls -lrt

total 20

drwx------ 2 root root 4096 Mar 18 16:12 dCjJGL

-rwx------ 1 root root 1904 May 11 09:38 SERVICES

drwx------ 2 root root 4096 May 18 10:20 uE4Pkn

-rw------- 1 root root 7 May 18 10:21 DEFAULT

-rw------- 1 root root 2552 May 18 10:28 INFO

root@server:/usr/syno/etc/certificate/_archive# cd dCjJGL/

root@server:/usr/syno/etc/certificate/_archive/dCjJGL# ls -l

total 52

-r-------- 1 root root 1890 Mar 18 16:12 cert.pem

-r-------- 1 root root 1801 Mar 18 16:12 chain.pem

-r-------- 1 root root 1390 Mar 18 16:12 ECC-cert.pem

-r-------- 1 root root 1566 Mar 18 16:12 ECC-chain.pem

-r-------- 1 root root 2958 Mar 18 16:12 ECC-fullchain.pem

-r-------- 1 root root 241 Mar 18 16:12 ECC-privkey.pem

-r-------- 1 root root 3693 Mar 18 16:12 fullchain.pem

-r-------- 1 root root 1704 Mar 18 16:12 privkey.pem

-r-------- 1 root root 262 Mar 18 16:12 renew.json

-r-------- 1 root root 1890 Mar 18 16:12 RSA-cert.pem

-r-------- 1 root root 1801 Mar 18 16:12 RSA-chain.pem

-r-------- 1 root root 3693 Mar 18 16:12 RSA-fullchain.pem

-r-------- 1 root root 1704 Mar 18 16:12 RSA-privkey.pem

root@server:/usr/syno/etc/certificate/_archive/uE4Pkn# openssl x509 -in cert.pem -noout -ext subjectAltName -subject | grep -E "Subject:|DNS:"

DNS:*.domain.com, DNS:domain.com

root@server:/usr/syno/etc/certificate/_archive/dCjJGL# openssl pkcs12 -export \

> -in cert.pem \

> -inkey privkey.pem \

> -certfile chain.pem \

> -out unifi.p12 \

> -name unifi \

> ls -lrt^C

root@server:/usr/syno/etc/certificate/_archive/dCjJGL# ls -l

total 60

-r-------- 1 root root 1890 Mar 18 16:12 cert.pem

-r-------- 1 root root 1801 Mar 18 16:12 chain.pem

-r-------- 1 root root 1390 Mar 18 16:12 ECC-cert.pem

-r-------- 1 root root 1566 Mar 18 16:12 ECC-chain.pem

-r-------- 1 root root 2958 Mar 18 16:12 ECC-fullchain.pem

-r-------- 1 root root 241 Mar 18 16:12 ECC-privkey.pem

-r-------- 1 root root 3693 Mar 18 16:12 fullchain.pem

-r-------- 1 root root 1704 Mar 18 16:12 privkey.pem

-r-------- 1 root root 262 Mar 18 16:12 renew.json

-r-------- 1 root root 1890 Mar 18 16:12 RSA-cert.pem

-r-------- 1 root root 1801 Mar 18 16:12 RSA-chain.pem

-r-------- 1 root root 3693 Mar 18 16:12 RSA-fullchain.pem

-r-------- 1 root root 1704 Mar 18 16:12 RSA-privkey.pem

-rw------- 1 root root 4344 May 18 22:01 unifi.p12

root@server:/usr/syno/etc/certificate/_archive/dCjJGL# mv unifi.p12 /volume1/docker/unifi/data/ && cd /volume1/docker/unifi/data/

root@server:/volume1/docker/unifi/data# ls -l

total 228

drwxr-xr-x+ 3 admin users 4096 Mar 6 15:53 backup

drwxr-xr-x+ 4 admin users 40960 May 18 22:01 db

-rwxr-xr-x+ 1 root root 35879 May 18 09:41 firmware.json

-rwxr-xr-x+ 1 admin users 6502 May 11 09:39 keystore

-rwxr-xr-x+ 1 admin users 2742 Aug 28 2023 keystore-2023-08-28.bak

-rwxr-xr-x+ 1 root root 6502 May 18 21:57 keystore-2026-05-18.bak

-rwxr-xr-x+ 1 admin users 1424 May 18 21:40 model_lifecycles.json

-rwxr-xr-x+ 1 admin users 0 Oct 17 2023 system_env

-rwxr-xr-x+ 1 root root 1394 May 11 09:40 system.properties

-rwxr-xr-x+ 1 root root 1394 May 11 09:40 system.properties.bk

-rwxr-xr-x+ 1 root root 110245 May 15 17:41 uidb.json

-rw------- 1 root root 4344 May 18 22:01 unifi.p12

root@server:/volume1/docker/unifi/data# docker exec -it unifi keytool -importkeystore \

> -srckeystore /unifi/data/unifi.p12 \

> -srcstoretype PKCS12 \

> -srcstorepass aircontrolenterprise \

> -destkeystore /unifi/data/keystore \

> -deststoretype JKS \

> -deststorepass aircontrolenterprise \

> -alias unifi

Importing keystore /unifi/data/unifi.p12 to /unifi/data/keystore...

Existing entry alias unifi exists, overwrite? [no]: yes

root@server:/volume1/docker/unifi/data#

Plex (password = plex)

root@server:/usr/syno/etc/certificate/_archive/uE4Pkn# openssl pkcs12 -export -out /volume1/PlexMediaServer/plex_wildcard.pfx \

> -inkey privkey.pem \

> -in cert.pem \

> -certfile chain.pem \

> -certpbe AES-256-CBC \

> -keypbe AES-256-CBC \

> -macalg SHA256

Enter Export Password:

Verifying - Enter Export Password:

Wednesday, August 30, 2023

Unifi Controller: update your SSL certificate

I am running my Unifi Controller (UC) inside a Docker container on my Synology from the excellent image provided by Jacob Alberty. I needed to update my SSL certificate and it took some time for me to figure out how to do that again.

My setup is that I have a number of folders mapped from the container to a volume on my NAS. /volume1/docker/unifi contains 3 folders: cert, data and logs. The cert folder contains the necessary SSL certificate. All my files are with extension *.pem and are also in the PEM format. Although the logging later on will hint that you should use the PKCS12 format, PEM works fine as well.
The files that are needed are:

cert.pem # The Certificate
privkey.pem # Private key for the cert
chain.pem # full cert chain (this includes your intermediate pasted first, and right under it your root certificate)

Login to your Synology through SSH
Idenfity the Docker container ID of your UC

docker ps

CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS              PORTS                                                                                                                                                                                NAMES
78bd86bc763a        7cdd2aec3527                   "/usr/local/bin/docke"   12 months ago       Up 23 minutes       0.0.0.0:6789->6789/tcp, 0.0.0.0:8080->8080/tcp, 0.0.0.0:8443->8443/tcp, 0.0.0.0:8843->8843/tcp, 0.0.0.0:3478->3478/udp, 0.0.0.0:10001->10001/udp, 6789/udp, 0.0.0.0:8880->8880/tcp   unifi

Create a backup of your running SSL certificate into the folder _backups

cd /volume1/docker/unifi/cert && mv *.pem _backups/

Copy your new files onto your Synology (/usr/syno/etc/certificate/system/default) and keep the naming as mentioned above: cert.pem, privkey.pem and chain.pem.
Check the permissions and set them to user only

chmod 400 *.pem*

Restart the Docker container (through command line or the Synology webconsole)
Monitor the progress of the container rebooting. Replace 78bd86bc763a with your actual container ID. The below highlights that a new certificate was found and it is being updated in the UC. In the case where you keep seeing the old certificate after rebooting, you have probably updated the cert in the wrong place. Try again.

docker logs -f 78bd86bc763a

[2019-02-09 08:08:13,866]  Starting unifi controller service.
[2019-02-09 08:08:13,868]  WARNING: Running UniFi in insecure (root) mode
[2019-02-09 08:12:27,477]  Exit signal received, shutting down
[2019-02-09 08:12:33,211]  Cert directory found. Checking Certs
[2019-02-09 08:12:33,440]  Cert has changed, updating controller...
[2019-02-09 08:12:33,443]  Using openssl to prepare certificate...
[2019-02-09 08:12:33,488]  Removing existing certificate from Unifi protected keystore...
[2019-02-09 08:12:33,903]  Inserting certificate into Unifi keystore...
Importing keystore /tmp/tmp.cuWCGLJI1p to /unifi/data/keystore...

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /unifi/data/keystore -destkeystore /unifi/data/keystore -deststoretype pkcs12".
[2019-02-09 08:12:34,684]  Cleaning up temp files
[2019-02-09 08:12:34,688]  Done!
[2019-02-09 08:12:34,692]  Starting unifi controller service.
[2019-02-09 08:12:34,693]  WARNING: Running UniFi in insecure (root) mode

Try to browse to the UC and check the certificate in your browser. Keyboard shortcut Command+Option+J in Chrome on Mac.

Friday, August 2, 2019

Renew your wildcard certificate on your DSM Webstation and OpenVPN server

Are you having a wildcard (*.yourdomain.com) SSL certificate that is expiring and needs a renewal? Below are the steps to take to renew it on a Synlogy DSM. I also use the certificate for the OpenVPN server on the DSM. So I need to update it twice.

Convention:

Certificate: server.crt
Private key: server.key
Intermediate: ca_bundle.crt
Root: ca.crt

Receive a new wildcard certificate

Login in DSM https://ip:5001
SSH into the DSM

cd /usr/syno/etc/packages/VPNCenter/openvpn/keys

copy the ca_bundle.crt file
In the DSM: Control Panel > Security > Certificate
Click on CSR, then renew certificate
Select the Country and download CSR and the private key.
Go to ssl2buy.com to buy a new wildcard certificate from alphassl.com
Enter the CSR (generated by your DSM) and select approval method admin@yourdomain.com
Go to your webmail and login with the admin@yourdomain.com account to check for the email to approve your new purchase
Click on the approval email request to issue out the certificate (you get an email with the certificate from ssl2buy)
Add a new certificate by entering the server.key, server.crt and ca_bundle.crt files in the wizard
Click on Edit to set the new certificate as the Default one, then remove the old (inactive) one. The webserver should restart itself now with the new certificate

Tip: The intermediate certificate (in base64 format) from AlphaSSL can be downloaded here

Update the certificates for the OpenVPN server

SSH into the DSM and make yourself root

sudo -i
cd /usr/syno/etc/packages/VPNCenter/openvpn/keys

Make a new folder for the last time you created/renewed your certificate under "history" directory. Move the (old) certificates there to as a backup.

mkdir history/YYYY-MM-DD
mv server.* history/YYYY-MM-DD
cp -rp ca* history/YYYY-MM-DD

Add the new private key, certificate and intermediate by doing vi server.key ... Do this for the 2 server files mentioned under Convention.
Make the files owner readable only

chmod 400 server*
chmod 400 ca*

Restart the OpenVPN server

/var/packages/VPNCenter/target/scripts/openvpn.sh restart

And you should be good to go for another year...

Friday, March 23, 2018

Renew your Let's Encrypt certificate

You are using a Let's Encrypt certificate, but get the warning that it will expire. These are the quick steps to renew it.

Adapt your DNS and point it for the domain to your public IP (if it is currently pointing to an internal IP e.g. 192.168.Y.X)
Enable port forwarding for port 80/443 for this internal IP
Run the renewal
```
sudo certbot renew
```
If successful, disable the port forwarding again
Change the DNS again

Sunday, November 20, 2016

Enable HTTPS for EmonCMS on Raspbian

Our EmonCMS installation at home currently runs only over HTTP, which is not secure at all. Enabling HTTPS is a must do. However, there's a small tweak needed for it to work at the AllowOverride option.
Tip: If you run into the issue where you have HTTPS enabled, but the logging in returns always the login screen with message 'undefined', follow the fix explained below.

Check if HTTPS is already enabled for your Apache installation:

root@raspi1:~# netstat -an | grep LISTEN
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN

As you can see, there is nothing running on port 443 (HTTPS) yet, so we'll need to enable the HTTPS configuration for Apache.

Enable the default HTTPS (SSL) configuration for Apache:

1. Check if the SSL module is already enabled for Apache.

root@raspi1:~# ls -l /etc/apache2/mods-enabled/*ssl*
root@raspi1:~#

If nothing is returned, the module is not enabled yet and needs to be linked from /etc/apache2/mods-available/

2. Make a symbolic link for the SSL module.

root@raspi1:~# cd /etc/apache2/mods-enabled/
root@raspi1:~# ln -s ../mods-available/ssl.conf ssl.conf
root@raspi1:~# ln -s ../mods-available/ssl.load ssl.load

3. Make a symbolic link for the SSL config file.

root@raspi1:~# cd /etc/apache2/sites-enabled/
root@raspi1:~# ln -s ../sites-available/default-ssl 000-default-ssl

4. Change two lines in the config file.

        DocumentRoot /var/www
        <Directory />
                Options FollowSymLinks
                #Changed None to All on 18/11/2016
                AllowOverride All
        </Directory>
        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                #Changed None to All on 18/11/2016
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>

5. Restart your Apache now.

root@raspi1:~# /etc/init.d/apache2 restart

This tip came from here.