Ter referentie welke bestanden met welke rechten.
Bron: https://community.ui.com/questions/How-to-install-a-SSL-Certificate-on-Unifi-Cloud-Key/944dbbd6-cbf6-4112-bff5-6b992fcbf2c4

#!/bin/bash
 
#
#
#
# 1. Save this script in a folder of your choosing as 'ssl_script.sh' or whatever name you choose
# 2. chmod +x ssl_script.sh
# 3. Provide the following files (for 1&1 signed certificates)
#    PRIVATE.key
#    SSL_CERTIFICATE.cer
#    INTERMEDIATE.cer
# 4. Run by typing './ssl_script.sh'
#
#
#
 
# Backup current certificate. Just in case. Can never be too careful
tar -zcvf /root/CloudKeySSL_`date +%Y-%m-%d_%H.%M.%S`.tgz /etc/ssl/private/*
 
# Delete current files
rm -f   /etc/ssl/private/cert.tar                           \
        /etc/ssl/private/unifi.keystore.jks                 \
        /etc/ssl/private/unifi.keystore.jks.md5             \
        /etc/ssl/private/cloudkey.crt                       \
        /etc/ssl/private/cloudkey.key
 
# Unpack certificates
openssl pkcs12 -export -out unifi.p12 -inkey PRIVATE.key -in SSL_CERTIFICATE.cer -certfile INTERMEDIATE.cer -password pass:your_own_password
openssl pkcs12 -in unifi.p12 -nodes -out /etc/ssl/private/cloudkey.key -nocerts -password pass:your_own_password
cp SSL_CERTIFICATE.cer /etc/ssl/private/cloudkey.crt
 
# For certificates in x509 format - replace the 'cp ... ' line above with this
#
# openssl x509 -inform der -in unifi.cer  -out /etc/ssl/private/cloudkey.crt
#
 
# Decrypt keys and convert certificates to plain text
# Note, aircontrolenterprise is not arbitrary. this is what UniFi is expecting
openssl pkcs12 -export -in /etc/ssl/private/cloudkey.crt    \
                    -inkey /etc/ssl/private/cloudkey.key    \
                      -out /etc/ssl/private/cloudkey.p12    \
                      -name unifi -password pass:aircontrolenterprise
 
# Import keys into Java Key Store
keytool -importkeystore -deststorepass aircontrolenterprise \
            -destkeypass aircontrolenterprise               \
            -destkeystore /usr/lib/unifi/data/keystore      \
            -srckeystore /etc/ssl/private/cloudkey.p12      \
            -srcstoretype PKCS12 -srcstorepass aircontrolenterprise -alias unifi
 
# Cleanup
rm -f /etc/ssl/private/cloudkey.p12
rm -f unifi.p12
 
pushd /etc/ssl/private
 
# Create tar file cloudkey expects
tar -cvf cert.tar *
 
# set permissions
chown root:ssl-cert /etc/ssl/private/*
chmod 640           /etc/ssl/private/*
 
popd
 
# Test
/usr/sbin/nginx -t
 
# Restart nginx and UniFi Controller
echo "Press enter to restart nginx and unifi"
read
 
/etc/init.d/nginx restart
/etc/init.d/unifi restart