0

I'm trying to setup the Unifi-Controller in a docker. I used a macvlan bridge to give the docker access to the web. The problem is when I try to access the controller via https://<ipaddress>:8443. The issue is chrome won't let me access the site because it is not secure. I think there is an issue with SSL certificates. Here are my settings:

First I created a macvlan:

docker network create -d macvlan --subnet=192.168.1.43/24 --gateway=192.168.1.43  -o parent=eth0 pub_net

Then created the link:

ip link add mac0 link eth0 type macvlan mode bridge
ip addr add 192.168.1.42/24 dev mac0
ifconfig mac0 up
ip route add 192.168.1.42 dev mac0

lastly my docker container definition

sudo docker run \
    --name=unifi \
    --restart on-failure \
    --net=pub_net \
    --ip=192.168.1.42 \
    -e PGID=1000 -e PUID=1000 \
    -p 3478:3478/udp \
    -p 10001:10001/udp \
    -p 8080:8080 \
    -p 8081:8081 \
    -p 8443:8443 \
    -p 8843:8843 \
    -p 8880:8880 \
    -p 6789:6789 \
    -v unifi_data:/data \
    -v unifi_data:/config \
    linuxserver/unifi

I suspect I need to add an SSL certificate into my docker. Any suggestions as to how to do that would be much appreciated

If it helps, I used to run the controller in a KVM host, but I wanted to streamline the setup. When it was running in the VM I didn't have any issues accessing the controller via https://<vm_ipaddress>:8443

0

It says the site is not secure because the built-in SSL certificate is self-signed. That is expected and is true of 90% of Unifi setups that I have seen.

As a matter of fact, if you are accessing the site by IP address you don't really have a choice since trusted SSL issuers will not issue a certificate for an IP address, only for a hostname. (Technically you can add this certificate to your "Trusted Root Certificates", but that is not recommended.)

You should be able to click "Advanced" and then "Proceed to <ipaddress> (unsafe)".

NOTE: In general you should not bypass this warning for websites on the Internet, since it could mean that someone has intercepted the connection. However, doing this for a site that you access by IP Address internally is totally fine.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.