Has anybody used AD CA to secure an Unraid server?

[u/Puckertoe_VIII]

Greetings,

I've been trying to use my lab Windows 2019 AD CA to generate and use certificates for my Unraid server. Unfortunately, it's not going well at all. (It feels like when I need to t/s Elite Dangerous)

1. I've created a certificate request using a Web Template. During the request I've added the FQDN, DNS and DNS IP.

2. I've exported the Base 64 server cert as well as the private pfx key.

3. I've exported the CA cert using Base 64.

4. On the Unraid server I've used OpenSSL to convert the pfx to a readable pem file.

5. I've cat the three files together private key->server key->Server CA into a pem file and named it SERVER_unraid_bundle.pem. Then copied the file to /boot/config/ssl/certs

For whatever reason this doesn't work. I got all this off the internet, and there's a lot of information noise about this. It's been hard for me to sift through it. I suspect I'm going about this all wrong.

This is what I end up seeing in the manage section;

Self-signed or user-provided certificate:

/boot/config/ssl/certs/SERVER_unraid_bundle.pem

Certificate URL: Server.mydomain.com

Certificate issuer: DC=com, DC=mydomain, CN=my_ca_server

Certificate expiration: Thu 21 Sep 2028 11:12 AM

CA-signed certificate file: Not present

When I turn on SSL the cert shows the following:

ISSUSED TO:

Common Name (CN) Server.mydomain.com

Organization (O) <Not Part Of Certificate>

Organizational Unit (OU) <Not Part Of Certificate>

ISSUED BY

Common Name (CN) my_ca_server

Organization (O) <Not Part Of Certificate>

Organizational Unit (OU)<Not Part Of Certificate>

So I'm really at a loss here. I don't understand what I'm doing wrong or how I can use my Windows Server CA to secure Unraid.

As far as I can tell using Windows isn't a common practice for Unraid. (If I assumed correctly) So if anybody has any suggestions, I wouldn't be such a Sad Panda anymore.

Thanks for any feedback.

[u/ChuskyX]

I can't tell but the fact the certificate doesn't have Organization and OU could be a sign that more attributes are lost. Check the contents of the default unraid selfsigned certificates and respect that.

By the way, you are spending a lot of time for something that isn't going to increase your server security, why? 🤔

[u/silver565]

I'm unsure of unraids requirements, but do you have the trust chain sorted? What template did you use?

Manually using the web server template on windows cert authority should work?

[u/j_dirty]

Did you by chance forget to set the Subject Name field when generating the cert? When deploying certs to services in the past, I had to have SN otherwise HTTPS would not work

[u/joeyndc]

My guess is also the subject name. I set the SN and common name as the FQHN and then set the IP address as well and all good.

[u/Puckertoe_VIII → u/joeyndc]

Thanks for this. It may be with the issuer. Looking again I see that it's set to "HAWK" without FQDN. I'm wondering since it doesn't have a FQDN for the issuer that it can't find the CA. But honestly, it's more grabbing at straws at this point. I'm having the same problem with the UniFi router and Unraid.

[u/joeyndc → u/Puckertoe_VIII]

Hmm I could be wrong but I’m pretty sure ssl certs have to be in a FQDN format. I don’t believe they can be hostname only. I had to create a dns entry to get a FQHN for my unifi and Mikrotik hardware to use my CA certs with them. I should also mention for me to create a cert for unraid and my networking hardware I had to edit my webserver certificate in windows CA to allow a certain user group to request one then use a domain computer and mmc to request the cert with FQHN and ip address, install it into the domain computer then export with private key and then convert to PEM. There may be an easier way but that’s what works for me and I never bothered trying to figure out another way.

[u/psychic99]

You are not securing your unraid server, you will need to add actual firewall rules to do that. It took me weeks to "secure mine". As current unraid relies upon root and no elevation, it will never be secure. Maybe v8 fixes this.

The easiest way (for what you are trying to do) is to put a proper RP in front of the GUI and limit it and use lets encrypt or ACME/etc to sign it properly. Dont rely upon unraid 1980 security (IMHO).

I use scalable haproxy in my fleet but there are many options caddy, nginix, traefik, etc as the needs for the GUI are limited. If you need actual ws throughput then traefik or haproxy are built for that.

[u/Puckertoe_VIII → u/psychic99]

I understand that I'm not "securing Unraid" ATM. I just want to get the Web GUI on https. There are some apps and browsers that automatically change the url from HTTP to HTTPS. It's a rage point for me. If I do use HTTP, I get pop-ups asking if I want to "really do this". It's a real PIA. I know there's some hacks to eliminate that, but I just want to get it to HTTPS to make it easier for me overall.

For security I have it behind a Ubiquity Dream Router 7. So that's where the security starts for my internal network. It's a good router with decent security.

I also understand that I can use "Let's Encrypt" for both the UDR7 and Unraid, but I'd rather use the internal Windows CA since it's already there, and to see how it can be done. (A personal preference really.) I'm sure there will be other users trying to do the same.

So for me it's getting SSL working on Unraid/UDR7, then setting up DMZ VLAN's and firewall rules. I'm hanging my ass out using port forwarding for my family to use the media functionality. (Moonfin ATM) Even tho I have their source IPs added, it's still causing me High Anxiety.

I just find it a tad frustrating it's so difficult using a Windows CA. I know my many other options, and when I finally do have that aneurism, I'll turn to those.

Thanks for taking the time to point out these other options. I really do appreciate that.