How to Generate a CSR on UniFi Cloud Key

This tutorial explains how to generate a CSR (Certificate Signing Request) on a Ubiquiti UniFi Cloud Key. The Cloud Key does not have a built-in CSR generator in its web interface, so you will create the CSR over SSH using OpenSSL. These steps apply to Cloud Key Gen1 and Gen2/Gen2+, as well as self-hosted UniFi Network Application installations running on Linux.

Generate a CSR on UniFi Cloud Key

If you have already generated your CSR, skip ahead to the UniFi Cloud Key SSL installation instructions.

You can also use our CSR Generator to create the CSR automatically rather than running OpenSSL commands on the device.

Requirements

• SSH access to your Cloud Key (enable SSH in the UniFi OS settings, or connect directly via the device’s IP on port 22).
• Basic familiarity with terminal commands.
• OpenSSL installed (pre-installed on Cloud Key firmware).

Step 1: Connect to the Cloud Key via SSH

Open a terminal (or PuTTY on Windows) and connect to your Cloud Key:

ssh [email protected]

Replace 192.168.1.x with your Cloud Key’s IP address. On UniFi OS devices (Gen2/Gen2+), log in with the credentials you set during initial setup.

Step 2: Back up existing certificate files (optional but recommended)

Before generating new files, create a backup of your current certificate directory:

cp -r /etc/ssl/private ~/cloudkey-cert-backup

This preserves your existing key and certificate so you can restore them if needed. The backup matters here: on a Cloud Key Gen1 the directory already holds the certificate and key the device is serving (cloudkey.crt and cloudkey.key), and the command in Step 3 writes the new key over cloudkey.key. Until you install the issued certificate, the certificate on the device and the key beside it no longer match, and restoring this backup is the only way to put the device back as it was.

Note for Gen2 and Gen2+: on devices running UniFi OS the active certificate and key are unifi-core.crt and unifi-core.key in /data/unifi-core/config/, not in /etc/ssl/private. Back up that directory instead, and generate the request into a path of your choice.

Step 3: Generate the CSR and private key

Run the following OpenSSL command to create a 2048-bit RSA private key and CSR in a single step. Replace every placeholder value with your own information:

openssl req -new -newkey rsa:2048 -nodes -sha256 \
  -subj "/C=US/ST=California/L=San Jose/O=Your Company LLC/CN=unifi.yourdomain.com" \
  -addext "subjectAltName=DNS:unifi.yourdomain.com" \
  -keyout /etc/ssl/private/cloudkey.key \
  -out /etc/ssl/private/cloudkey.csr

Note: The -addext flag requires OpenSSL 1.1.1 or later (shipped on Cloud Key Gen2/Gen2+ and on Gen1 devices running firmware 1.1.6+). If your device has an older OpenSSL version, you can omit -addext and add the SAN through an OpenSSL configuration file instead, or use the CSR Generator. On OpenSSL 3.x you may use -noenc instead of -nodes; both produce an unencrypted private key.

CSR field reference

Each field in the -subj string maps to a certificate attribute. Fill them in as follows:

• C: two-letter country code (ISO 3166), for example US.
• ST: state or province (full name, not abbreviated).
• L: city or locality.
• O: your organization’s legal name. For Domain Validation (DV) certificates this field is optional.
• CN: the fully qualified domain name (FQDN) you will use to access the Cloud Key controller, for example unifi.yourdomain.com.

The -addext "subjectAltName=..." line sets the Subject Alternative Name (SAN) field. Modern browsers require the hostname to appear in the SAN, not only in the CN. If you need to cover more than one hostname, separate them with commas:

-addext "subjectAltName=DNS:unifi.yourdomain.com,DNS:cloudkey.yourdomain.com"

Step 4: Verify the CSR

Before submitting the CSR, confirm that the subject details and SAN are correct:

openssl req -in /etc/ssl/private/cloudkey.csr -noout -text

Look for the Subject: line (should match your -subj values) and the X509v3 Subject Alternative Name section (should list your FQDN). You can also paste the CSR contents into the SSL Dragon CSR Decoder for a visual check.

Step 5: Submit the CSR to your Certificate Authority

Open the CSR file in a text editor or print it to the terminal:

cat /etc/ssl/private/cloudkey.csr

Copy the entire output, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines. Paste it into the CSR field during the SSL certificate order process with your CA.

Keep the private key file (/etc/ssl/private/cloudkey.key) on the Cloud Key. You will need it later when you install the SSL certificate into the UniFi keystore.

Step 6: Secure the private key

Restrict the key file so only root can read it:

chmod 600 /etc/ssl/private/cloudkey.key

Never share or transfer the private key over an unencrypted channel. If you suspect it has been compromised, generate a new CSR and reissue the certificate.