[Help]: I used the UI to install SSL/TLS Certificates - how do I undo that?

[madpah]

Controller Version

v5.15.6.7

Describe Your Issue or Question

As called out in the README, if you want custom certificates to be used that are mounted into your Container, you should NOT use the UI to install cerificates.

For those (myself included) that did not pay attention, how can this be undone?

Expected Behavior

A guide to explain how to uninstall certificates installed via UI would be nice 😄

Steps to Reproduce

1. Run the omada-controller container
2. Install certificates using the Omada Controller UI, even if you have mounted certificates into the Container

How You're Launching the Container

I'm using docker compose with the following service definition:

services:
      omada-controller:
      container_name: omada-controller
      image: mbentley/omada-controller:5.15.6.7
      restart: unless-stopped
      ulimits:
        nofile:
          soft: 4096
          hard: 8192
      stop_grace_period: 60s
      network_mode: host
      environment:
        - PUID=508
        - PGID=508
        - MANAGE_HTTP_PORT=8088
        - MANAGE_HTTPS_PORT=8043
        - PORTAL_HTTP_PORT=8088
        - PORTAL_HTTPS_PORT=8843
        - PORT_APP_DISCOVERY=27001
        - PORT_ADOPT_V1=29812
        - PORT_UPGRADE_V1=29813
        - PORT_MANAGER_V1=29811
        - PORT_MANAGER_V2=29814
        - PORT_DISCOVERY=29810
        - PORT_TRANSFER_V2=29815
        - PORT_RTTY=29816
        - SHOW_SERVER_LOGS=true
        - SHOW_MONGODB_LOGS=false
        - TZ=Europe/London
      volumes:
        - /opt/docker/omada/data:/opt/tplink/EAPController/data
        - /opt/docker/omada/logs:/opt/tplink/EAPController/logs
        - /etc/letsencrypt/live/REDACTED/fullchain.pem:/cert/tls.crt:ro
        - /etc/letsencrypt/live/REDACTED/privkey.pem:/cert/tls.key:ro

Container Logs

There are no issues in the logs - everything works as expected/documented.

MongoDB Logs

There are no issues in the logs - everything works as expected/documented.

Additional Context

No response

[madpah]

I posted the above discussion, so I could also provide my answer!

If certificates have been installed using the Omada Controller UI, they are (as documented here) stored in the MongoDB.

To resolve this, we need to adjust some contents in the MongoDB Database, and restart the Omada Controller container.

Here's what I did...

1. Ensure your Omada Controller container is already up, running and happy
2. Get a shell into the running Omada Controller container - replace omada-controller with the name of your container:
   docker exec -it omada-controller /bin/bash
3. Update apt:
   apt-get update
4. Install mongodb-clients so we can connect to the MongoDB Database:
   apt-get install mongodb-clients
   We can now connect to the MongoDB database and make some edits to the system settings
5. Connect to MongoDB database using mongo client:
   mongo --port 27217
6. Change to the omada database collection
   use omada
7. Get the current System Settings object - we need to get the ID of this for step 9:
   db.systemsetting.findOne()
   This will return a large JSON looking object which will begin something like the below:

{
  "_id" : ObjectId("65b6a9f674fd5545d64340ec"),
  "certificate_setting" : {

9. We update the settings to disable the UI-installed certificates. We use the ID from Step 8 (65b6a9f674fd5545d64340ec) in the next command - make sure to use the ID you have, and not the one in this example!
   db.systemsetting.update({_id:ObjectId('65b6a9f674fd5545d64340ec')}, {$set: {certificate_setting: {enable: false}}});
   At this point, you can view System Settings in the Omada Controller UI and the HTTPS Settings will have been cleared - as per screenshot:
   
10. Exit MongoDB client with CRTL + C
11. Exit the shell into your Omada Controller container with CTRL + D
12. Restart your Omada Controller container - for me using my docker compose configuration above this would be:
    docker compose restart omada-controller

That's it - Omada Controller now respects the certificates I mount into the container (which I auto renew with certbot).

[mbentley]

Awesome - thank you for posting how to edit the settings in the db! It's certainly not easy to manipulate many settings once they've been set if they're stored in there.

One alternative to installing the mongo client in the container would be to run another container attached to the same network namespace; something like: docker run -it --rm --network container:omada-controller mongo:3 mongo --port 27217 --host localhost assuming the container name is omada-controller and this will drop you directly in a mongo client shell. Essentially the same result though, just with some simplified steps.