Ubiquiti UniFi

Storage and virtualisation

Renews management certificates on UniFi OS and classic UniFi Network controllers over SSH with verified recovery.

What happens

The appliance sends the package to Ubiquiti UniFi over SSH, port 22.
Discovery matches the served SHA-256 to one active file binding or the controller’s unifi alias. An ambiguous binding is left unchanged.
UniFi OS uses PEM in the discovered direct file binding or override. A classic controller replaces the unifi alias in a staged copy of its JKS or PKCS12 keystore. Files and service state are retained before activation. If it fails: If activation or TLS verification fails, the previous identity and management service state are restored and checked again.
Verification requires the served leaf and complete supplied intermediate chain on the management port, normally 443 on UniFi OS or 8443 on classic controllers.

Connection: The appliance sends the package over SSH, port 22, and it runs on the device. No agent is installed.
Service ports: 443, 8443
You need: SSH access permitted to update certificate files and the management service. Classic controllers require the existing keystore password if it differs from the default.
Platform: UniFi OS consoles and UniFi Network on Linux
Actions: Discovery, Installation, Verification, Rollback
Packages: unifi-os-ssh
Note: Select INSTANCE_PATH from discovery. An observed certificate manager requires the rule’s TAKEOVER_MANAGEMENT choice; an active scheduled writer targeting the same binding needs that binding detached first. Other certificates and management services are left unchanged.
Retain the protected backup. Later rollback refuses files independently changed after deployment. The certificate issuer or an unknown firmware version alone is information, not proof of an active competing writer.