unfi-controller running in docker SSL issues

Question

I'm trying to setup the Unifi-Controller in a docker. I used a macvlan bridge to give the docker access to the web. The problem is when I try to access the controller via https://<ipaddress>:8443. The issue is chrome won't let me access the site because it is not secure. I think there is an issue with SSL certificates. Here are my settings:

First I created a macvlan:

docker network create -d macvlan --subnet=192.168.1.43/24 --gateway=192.168.1.43  -o parent=eth0 pub_net

Then created the link:

ip link add mac0 link eth0 type macvlan mode bridge
ip addr add 192.168.1.42/24 dev mac0
ifconfig mac0 up
ip route add 192.168.1.42 dev mac0

lastly my docker container definition

sudo docker run \
    --name=unifi \
    --restart on-failure \
    --net=pub_net \
    --ip=192.168.1.42 \
    -e PGID=1000 -e PUID=1000 \
    -p 3478:3478/udp \
    -p 10001:10001/udp \
    -p 8080:8080 \
    -p 8081:8081 \
    -p 8443:8443 \
    -p 8843:8843 \
    -p 8880:8880 \
    -p 6789:6789 \
    -v unifi_data:/data \
    -v unifi_data:/config \
    linuxserver/unifi

I suspect I need to add an SSL certificate into my docker. Any suggestions as to how to do that would be much appreciated

If it helps, I used to run the controller in a KVM host, but I wanted to streamline the setup. When it was running in the VM I didn't have any issues accessing the controller via https://<vm_ipaddress>:8443

Answer 1

It says the site is not secure because the built-in SSL certificate is self-signed. That is expected and is true of 90% of Unifi setups that I have seen.

As a matter of fact, if you are accessing the site by IP address you don't really have a choice since trusted SSL issuers will not issue a certificate for an IP address, only for a hostname. (Technically you can add this certificate to your "Trusted Root Certificates", but that is not recommended.)

You should be able to click "Advanced" and then "Proceed to <ipaddress> (unsafe)".

NOTE: In general you should not bypass this warning for websites on the Internet, since it could mean that someone has intercepted the connection. However, doing this for a site that you access by IP Address internally is totally fine.