synoti logosynoti logo
Installation SSL Certificate

Protect your Unified Security Stack v1.7.22 deployment by correctly configuring SSL/TLS certificates. This document explains manual setup, automatic creation through Let's Encrypt, and renewing certificates.

All access to the Unified Security Stack v1.7.22 web interface must use HTTPS. Correct SSL certificate setup is critical for production environments.

Certificate Requirements

Supported Certificate Types

  • Self-signed certificates (development/testing only)

  • Commercial certificates from trusted CAs

  • Let's Encrypt certificates (recommended, free)

  • Enterprise PKI certificates

File Requirements

You need two files:

  • Certificate file: .crt or .pem extension

  • Private key file: .key or .pem extension

Under no circumstances share your private key. Keep it protected and backed up securely.

Method 1: Manual SSL Certificate Installation

Follow this approach when a Certificate Authority has already issued you a certificate.

Step 1: Prepare Certificate Files

After obtaining your certificate:

  1. Rename the certificate file to utm.crt

  2. Rename the private key file to utm.key

# Example renaming
mv your-certificate.crt utm.crt
mv your-private-key.key utm.key

Step 2: Transfer Files to Server

Copy both files to the Unified Security Stack certificate directory:

# Move certificate to Unified Security Stack directory
sudo mv utm.crt /synoti/cert/
sudo mv utm.key /synoti/cert/

# Set proper permissions
sudo chmod 600 /synoti/cert/utm.key
sudo chmod 644 /synoti/cert/utm.crt

Step 3: Restart Services

Restart Docker services to apply the new certificate:

sudo systemctl restart docker

Plan for about 10 minutes while every service finishes restarting.

Step 4: Verify Installation

# Check certificate
openssl x509 -in /synoti/cert/utm.crt -text -noout

# Verify web interface
curl -I https://your-domain.com

Your SSL certificate installation is complete! Open Unified Security Stack at https://your-domain.com

Method 2: Generate SSL with Let's Encrypt (Certbot)

Let's Encrypt supplies free, automated SSL certificates. Most deployments should use this recommended method.

Prerequisites

  • A registered domain name

  • Domain pointing to your Unified Security Stack server's public IP

  • Port 80 accessible from the internet (temporarily)

Step 1: Install Certbot

# Update package list
sudo apt update

# Install Certbot with Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

Step 2: Prepare Services

Stop the frontend service to allow Certbot to use port 80:

# Scale down frontend service
docker service scale synoti_frontend=0

# Verify frontend is stopped
docker ps | grep frontend

# Start Nginx temporarily
sudo systemctl start nginx

This Nginx instance is temporary and serves solely to generate certificates.

Step 3: Generate Certificate

Replace siem.yourdomain.com with your actual domain:

sudo certbot --nginx -d siem.yourdomain.com

Follow the prompts:

  1. Enter your email address

  2. Agree to Terms of Service

  3. Choose whether to share your email

  4. Certbot will automatically generate and configure your certificate

Step 4: Install Certificate in Unified Security Stack

# Copy certificate files to Unified Security Stack directory
sudo cp /etc/letsencrypt/live/*/fullchain.pem /synoti/cert/utm.crt
sudo cp /etc/letsencrypt/live/*/privkey.pem /synoti/cert/utm.key

# Set proper permissions
sudo chmod 600 /synoti/cert/utm.key
sudo chmod 644 /synoti/cert/utm.crt

Step 5: Restart Unified Security Stack Services

# Scale frontend back up
docker service scale synoti_frontend=1

# Verify frontend is running
docker ps | grep frontend

# Stop temporary Nginx
sudo systemctl stop nginx

# Restart Docker to apply changes
sudo systemctl restart docker

Your SSL certificate from Let's Encrypt is now active!

Certificate Renewal

Certificates from Let's Encrypt are valid for 90 days. Follow these steps to renew them.

Automatic renewal is built into Certbot. Confirm it is configured:

# Check renewal timer
sudo systemctl status certbot.timer

# Test renewal process (dry run)
sudo certbot renew --dry-run

Manual Renewal

If you need to renew manually:

Step 1: Stop Frontend Service

docker service scale synoti_frontend=0

Step 2: Renew Certificate

# Start Nginx for renewal
sudo systemctl start nginx

# Renew certificate
sudo certbot renew

# Stop Nginx
sudo systemctl stop nginx

Step 3: Update Unified Security Stack Certificates

Replace siem.yourdomain.com with your domain:

sudo cp /etc/letsencrypt/live/siem.yourdomain.com/fullchain.pem /synoti/cert/utm.crt
sudo cp /etc/letsencrypt/live/siem.yourdomain.com/privkey.pem /synoti/cert/utm.key

Step 4: Restart Services

docker service scale synoti_frontend=1
docker ps | grep frontend
sudo systemctl restart docker

Certificate Renewal Automation Script

Create an automated renewal script:

#!/bin/bash
# /root/renew-utm-cert.sh

# Stop frontend
docker service scale synoti_frontend=0
sleep 10

# Start Nginx and renew
systemctl start nginx
certbot renew --quiet
systemctl stop nginx

# Update certificates
cp /etc/letsencrypt/live/*/fullchain.pem /Unified Security Stack/cert/utm.crt
cp /etc/letsencrypt/live/*/privkey.pem /Unified Security Stack/cert/utm.key
chmod 600 /Unified Security Stack/cert/utm.key
chmod 644 /Unified Security Stack/cert/utm.crt

# Restart services
docker service scale synoti_frontend=1
sleep 30
systemctl restart docker

Make it executable and add to cron:

# Make executable
chmod +x /root/renew-utm-cert.sh

# Add to crontab (runs monthly)
(crontab -l 2>/dev/null; echo "0 3 1 * * /root/renew-utm-cert.sh") | crontab -

Alternative: Certbot with DNS Challenge

For environments where port 80 is not accessible:

# Install DNS plugin (example for Cloudflare)
sudo apt install python3-certbot-dns-cloudflare

# Create credentials file
echo "dns_cloudflare_api_token = YOUR_API_TOKEN" > ~/.secrets/cloudflare.ini
chmod 600 ~/.secrets/cloudflare.ini

# Generate certificate
sudo certbot certonly 
  --dns-cloudflare 
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini 
  -d siem.yourdomain.com

Many providers support DNS plugins, including Route53, Google Cloud DNS, Azure DNS, and others.

Troubleshooting

Certificate not recognized by browser

Possible causes:

  • Incorrect certificate chain

  • Self-signed certificate without import
    Solution:

  • Ensure you're using the fullchain.pem (includes intermediate certificates)

  • For self-signed: Import CA certificate to browser

Certbot fails with 'Port 80 already in use'

Solution:

# Stop any service using port 80
docker service scale synoti_frontend=0
sudo systemctl stop nginx
sudo systemctl stop apache2

# Check what's using port 80
sudo netstat -tlnp | grep :80
Certificate shows as expired

Solution:

  • Renew the certificate using the renewal process above

  • Check system date/time is correct

  • Verify certificate files are updated

Services won't restart after certificate update

Solution:

# Check Docker logs
docker service logs synoti_frontend

# Verify certificate files
openssl x509 -in /Unified Security Stack/cert/utm.crt -noout -dates
openssl rsa -in /Unified Security Stack/cert/utm.key -check

Certificate Monitoring

Monitor your certificate expiration:

# Check certificate expiration date
openssl x509 -enddate -noout -in /Unified Security Stack/cert/utm.crt

# Or check via web
echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

Security Best Practices

Use Strong Keys

  • Minimum 2048-bit RSA keys

  • 4096-bit recommended for high security

  • Consider ECDSA for better performance

Monitor Expiration

  • Set up expiration alerts

  • Renew 30 days before expiration

  • Test renewal process regularly

Protect Private Keys

  • Never share or expose private keys

  • Set proper file permissions (600)

  • Back up securely

smart_toy

Use Automation

  • Enable Certbot auto-renewal

  • Use scripts for updates

  • Monitor renewal logs

Wildcard Certificates

For multiple subdomains:

# Generate wildcard certificate
sudo certbot certonly 
  --manual 
  --preferred-challenges dns 
  -d "*.yourdomain.com" 
  -d "yourdomain.com"

Use the on-screen instructions to add the DNS TXT records required for validation.

Support

If you encounter issues during certificate installation or renewal, contact Unified Security Stack support or consult the community forums.