SSL Certificate for UniFi Controller

If you don’t want to (or can’t) run the UniFi Controller behind a proxy, sooner or later you face the challenge of replacing the bundled “self-signed” SSL certificate.

My internal UniFi environment runs on Windows and regularly requests Let’s Encrypt SSL certificates via CertBot, which then have to be copied from the PFX archive into the Java KeyStore of the UniFi Controller. The tool used for this is the Java “KeyTool”, which ships with the JDK.

For that, the “alias” of the certificate in the PFX archive is needed, which can be read with the KeyTool:

keytool.exe -v -list -storetype pkcs12 -keystore <Path-to-PFX> -storepass <PFX-Password> | findstr Alias

Then the desired certificate can be copied from the PFX into the KeyStore (the UniFi default password has to be used as the KeyStore password):

del .\keystore /Q
keytool.exe -importkeystore -srckeystore <Path-to-PFX> -srcstorepass <PFX-Password> -destkeystore keystore -srcstoretype pkcs12 -deststoretype jks -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destalias unifi -srcalias {<Cert-Alias (see above)>}

Finally, restart the UniFi Controller.