UniFi Controller issue with SSL from GoDaddy on EC

Question

Scenario

I have AWS setup for a unifi controller, I've been to access it with https://myserverip:8443, I bypass "This connection is note sucured" and use the controller normally

Now, I need to install and SSL certificate to get the hotspot payment system going.

I have a FQDN with GoDaddy so I created a subdomain unifi.mydomain.com, that points to the elastic IP, I log on with https://unifi.mydomain.com:8443

I bought the SSL certificate from GoDaddy, added the subdomain to that certificate.

I log on my AWS with SSH, generate my csr with the following command

cd /usr/lib/unifi
sudo java -jar lib/ace.jar new_cert unifi.mydomain.dom “My Company Name” City State CC*

Then I do

cd var/lib/unifi

more unifi_certificate.csr.pem

Once I get that I copy and paste it on GoDaddy, download the cert files, go back to AWS copy the files with filezilla to /usr/lib/unifi

Then I run the following command

sudo java -jar lib/ace.jar import_cert unifi_mydomain_com.crt bundlecert.crt

They import correctly, restart unifi service and reboot EC2

When I got to any of the above address I get the following

This site can’t provide a secure connection ERR_SSL_PROTOCOL_ERROR

I've tried different browsers, incognito mode, vpn, etc, I believe it's just a matter of SSL or my server

Answer 1

Check your system.properties which sits in /var/lib/unifi/ open the file with vim or your text editor of choice.

Have a look at your HTTPS options, the important ones are the ciphers and protocols.

The Protocols you need are TLSv1 and potentially SSLv2Hello there should be no other SSL protocols in there.

The Ciphers you ideally want are TLS, so for example TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA

If you are having issues throw them all in, CAUTION! only use this in a demo /test environment.

unifi.https.ciphers=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA

Remember once you have edited the system.properties you need to restart the controller.

sudo service unifi restart

Lots of help on the Unifi page

UniFi - SSL Certificate Error

UniFi - Explaining the config.properties File

UniFi - system.properties File Explanation