Securing Ubiquiti UniFi Cloud Key with Let’s Encrypt SSL and automatic dns-01 challenge with Cloudflare

I was trying to find out how to use Let’s Encrypt SSL to secure a internal unifi controller. Google gave me a link to the following excellent blogpost which describes how to use automatic dns-01 challenge to request and update the certificate from Let’s Encrypt:
https://www.naschenweng.info/2017/01/06/securing-ubiquiti-unifi-cloud-key-encrypt-automatic-dns-01-challenge/

Follow these steps to configure SSL/TLS-certificate for your internal unifi controller including automatic update of the certificate using Let’s encrypt and Cloudflare DNS:

1. Log in as root on your controller.

2. Install acme.sh via the online installer:
curl https://get.acme.sh | sh

3. Exit the terminal and reopen it again.

4. Enable auto-upgrade, just remember to change the email-address before executing the command:
acme.sh --upgrade --auto-upgrade --accountemail "mynotifaction@example.com"

5. Create the file /root/.acme.sh/cloudkey-renew-hook.sh:
#!/bin/bash
# Renew-hook for ACME / Let's encrypt
echo "** Configuring new Let's Encrypt certs"
cd /etc/ssl/private
rm -f /etc/ssl/private/cert.tar /etc/ssl/private/unifi.keystore.jks /etc/ssl/private/ssl-cert-snakeoil.key /etc/ssl/private/fullchain.pem

openssl pkcs12 -export -in /etc/ssl/private/cloudkey.crt -inkey /etc/ssl/private/cloudkey.key -out /etc/ssl/private/cloudkey.p12 -name unifi -password pass:aircontrolenterprise

keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /usr/lib/unifi/data/keystore -srckeystore /etc/ssl/private/cloudkey.p12 -srcstoretype PKCS12 -srcstorepass aircontrolenterprise -alias unifi

rm -f /etc/ssl/private/cloudkey.p12
tar -cvf cert.tar *
chown root:root /etc/ssl/private/*
chmod 640 /etc/ssl/private/*

echo "** Testing Nginx and restarting"
/usr/sbin/nginx -t
/etc/init.d/nginx restart ; /etc/init.d/unifi restart

6. Log in to your Clodflare account and get the Global API Code.

7. Configure exports for your DNS API:
export CF_Key="YOUR-CLOUDFLARE-API-KEY"
export CF_Email="YOUR-CLOUDFLARE-EMAIL"

8. Now it is time to get the new certificate. The following command will backup your existing certificate, contact Let’s encrypt to issue the new certificate, install the certificate and restart the controller. Remember to change the hostname in the parameter -d before running the command:
acme.sh --force --issue --dns dns_cf -d unifi.example.com --pre-hook "touch /etc/ssl/private/cert.tar; tar -zcvf /root/.acme.sh/CloudKeySSL_`date +%Y-%m-%d_%H.%M.%S`.tgz /etc/ssl/private/*" --fullchainpath /etc/ssl/private/cloudkey.crt --keypath /etc/ssl/private/cloudkey.key --reloadcmd "sh /root/.acme.sh/cloudkey-renew-hook.sh"

9. Log in to the controller and ensure that the hostname is configured.

10. Verify that a cronjob has been configured to enable automatic renewal of the certificate:
crontab -e
The line for acme.sh should look like the one below:
0 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh/" >> /var/log/letsencrypt.log

via Securing Ubiquiti UniFi Cloud Key with Let’s Encrypt SSL and automatic dns-01 challenge | naschenweng.info

Getting Started with VMware vSphere PowerCLI

VMware are providing vSphere PowerCLI to make it possible to administer vSphere and vCloud Director using PowerShell.

A good startingpoint is the VMware vSphere PowerCLI Documentation page that is available at: https://www.vmware.com/support/pubs/ps_pubs.html

If you´re in a hurry you could follow my quick starting guide below:

Step 1. Download and install VMware vShere PowerCLI:
VMware vSphere PowerCLI is available for download from http://www.vmware.com/support/developer/PowerCLI/index.html
Select the release you want to download from the drop-down list and click on the download-link.
Double-click on the downloaded installation-package and follow the instructions to install PowerCLI.

Step 2. Start PowerCLI and connect to a vCenter Server:
Double-click on the “VMware PowerCLI” icon to start PowerCLI.

PowerCLI
PowerCLI

Use the CmdLet ‘Connect-VIServer’ as shown below to connect to the vCenter Server:

Connect-VIServer -Server <server-IP> -Protocol https -Username '<Username>' -Password '<Password>'

Now you are ready to explore and manage the VMware vCenter environment using PowerShell. Start by executing the following CmdLet to list all available commands.

Get-VICommand