SSL Certificates For Local Network - Revision history

Dlk: /* On a Unifi Dream Machine (UDM/UDM-Pro) firewall/router/switch */

2021-04-05T19:46:05Z

On a Unifi Dream Machine (UDM/UDM-Pro) firewall/router/switch

Dlk: /* Create a server certificate that is signed with your private CA's root certificate */

2021-02-04T21:15:39Z

Create a server certificate that is signed with your private CA's root certificate

Dlk: /* Create a server certificate that is signed with your private CA's root certificate */

2021-02-04T21:13:36Z

Create a server certificate that is signed with your private CA's root certificate

Dlk: /* In the ntopng application on Linux */

2021-02-04T21:03:02Z

In the ntopng application on Linux

Dlk: /* On a Unifi Dream Machine UDM/UDM-Pro) firewall/router/switch */

2021-02-04T21:01:26Z

On a Unifi Dream Machine UDM/UDM-Pro) firewall/router/switch

Dlk: /* On a Unifi Dream Machine firewall/router/switch */

2021-02-04T21:01:14Z

On a Unifi Dream Machine firewall/router/switch

Dlk at 20:55, 4 February 2021

2021-02-04T20:55:38Z

Dlk: /* Installing the server certificate */

2021-02-04T20:36:23Z

Installing the server certificate

Dlk: /* In the ntopng application on Linux */

2021-02-04T19:08:43Z

In the ntopng application on Linux

Dlk: /* Installing the CA certificate */

2021-02-04T19:01:59Z

Installing the CA certificate

← Older revision		Revision as of 19:46, 5 April 2021
Line 55:		Line 55:

	==== On a Unifi Dream Machine (UDM/UDM-Pro) firewall/router/switch ====		==== On a Unifi Dream Machine (UDM/UDM-Pro) firewall/router/switch ====
		+
		+	'''WARNING:''' Don't do this, it prevents Protect mobile phone and Android TV apps from working. Stick with the self-signed certificates as distributed.

	# Copy the server's full chain file to <code>/mnt/data/unifi-os/unifi-core/config/unifi-core.crt</code>		# Copy the server's full chain file to <code>/mnt/data/unifi-os/unifi-core/config/unifi-core.crt</code>

@@ Line 35: / Line 35: @@
 # Select the <code>Source</code> tab and select either the name of the custom template created in the step above or <code>[default] TLS_server</code> under <code>Template for new certificate</code>.  Click the <code>Apply all</code> button,
 # Select the <code>Subject</code> tab and fill in the <code>Internal Name</code> field with a name for this certificate and the <code>commonName</code> field with the fully-qualified hostname or IP address of the server that will use this certifcate.
-#* If you create a certificate for your entire domain using a wildcard for the hostname, i.e., <code>*.localdomain</code>, this is called a wildcard certificate and it is valid for any and all servers whose hostnames match that wildcard pattern.  That's one way to simplify things.  Create one certificate and use that same certificate on all of the servers within that domain.
+#* '''Note:''' If you create a certificate for your entire domain using a wildcard for the hostname, i.e., <code>*.localdomain</code>, this is called a wildcard certificate and it is valid for any and all servers whose hostnames match that wildcard pattern.  That's one way to simplify things.  Create one certificate and use that same certificate on all of the servers within that domain.
 # Click the <code>Generate a new key</code> button.  Enter a name for the key.  I use the server hostname for the name.
 # The default life of the certificate will be 365 days.  If you need to change this, go to the <code>Extensions</code> tab.
-# To add additional server hostnames that this certificate can be used for:
+# ''Optional:'' To add additional server hostnames that this certificate can be used for:
 ## Click the <code>Edit</code> button next to the <code>X509v3 Subject Alternative Name</code> field on the <code>Extensions</code> tab,
 ## Click the <code>Add</code> in the popup that appears, set the <code>Type</code> field to "DNS" and the <code>Content</code> to the additional hostname.  Repeat until all the names you want to support have been added.

@@ Line 35: / Line 35: @@
 # Select the <code>Source</code> tab and select either the name of the custom template created in the step above or <code>[default] TLS_server</code> under <code>Template for new certificate</code>.  Click the <code>Apply all</code> button,
 # Select the <code>Subject</code> tab and fill in the <code>Internal Name</code> field with a name for this certificate and the <code>commonName</code> field with the fully-qualified hostname or IP address of the server that will use this certifcate.
 # Click the <code>Generate a new key</code> button.  Enter a name for the key.  I use the server hostname for the name.
 # The default life of the certificate will be 365 days.  If you need to change this, go to the <code>Extensions</code> tab.

@@ Line 61: / Line 61: @@
 ==== In the ntopng application on Linux ====
-#  Concatenate the server's full chain file and key file together into a single file called <code>ntopng-cert.pem</code>.  Place this file into the <code>/usr/share/ntopng/httpdocs/ssl</code> directory and restart the application.
+#  Concatenate the server's full chain file and key file together into a single file, <code>/usr/share/ntopng/httpdocs/ssl/ntopng-cert.pem</code>, and restart the application.
 === Trusting the CA certificate ===

@@ Line 53: / Line 53: @@
 # Restart the httpd service
-==== On a Unifi Dream Machine UDM/UDM-Pro) firewall/router/switch ====
+==== On a Unifi Dream Machine (UDM/UDM-Pro) firewall/router/switch ====
 # Copy the server's full chain file to <code>/mnt/data/unifi-os/unifi-core/config/unifi-core.crt</code>

@@ Line 37: / Line 37: @@
 # Click the <code>Generate a new key</code> button.  Enter a name for the key.  I use the server hostname for the name.
 # The default life of the certificate will be 365 days.  If you need to change this, go to the <code>Extensions</code> tab.
 # Click the <code>OK</code> button at the lower right to generate and save the root certificate.
 # Export both the server certificate combined with the CA certificate used to sign it by selecting the <code>PEM chain (*.pem)</code> export format.

@@ Line 53: / Line 53: @@
 #  Concatenate the server's full chain file and key file together into a single file called ntopng-cert.pem.  Place this file into the <code>/usr/share/ntopng/httpdocs/ssl</code> directory and restart the application.
-=== Installing the CA certificate ===
+=== Trusting the CA certificate ===
 ==== On Fedora Linux clients ====
 # Put the certifcate authority root certificate that we exported during the first step above into the <code>/etc/pki/ca-trust/source/anchors/</code> directory on each client,