I am looking for the exact same solution. Returning to the gui to re-upload a cert periodically is not desirable when there are plenty of good ways to automate certificate creation.

I've poked around a little at the UI to see if it would be feasible via wget automation, but the login flow appears to be somewhat complex.

  @d0ugmac1 

I got some API commands working and uploaded a new cert in a debug environment last night. I just need to clean up my script and get it pushed back to github.

I'll share it as soon as I can.

  @ragejage 

  @peterdeg 

I got this working locally to upload PEM cert/privkey from Let's Encrypt: https://github.com/jsestrich/omada-api/blob/main/upload_cert.py

You'll need to setup an omada.cfg file (see the Settings file in the README https://github.com/jsestrich/omada-api#settings).

I am using certbot on my omada server. I have created a deploy renewal-hooks script which replaces the Omada keystore and certificate after renewing the certificate. A new keystore needs to be created with the correct password defined in the omada config file. After replacing the keystore the Omada controller needs to be restarted. This has worked for me for almost a year now.

Hope this helps.

---

#!/bin/bash
umask 027

CERT=$RENEWED_LINEAGE/cert.pem
KEY=$RENEWED_LINEAGE/privkey.pem
CHAIN=$RENEWED_LINEAGE/fullchain.pem
BUNDLE=/tmp/omada.p12
KEYSTORE=/tmp/omada.keystore

PASSWORD=tplink

# Create a PKCS12 bundle
/usr/bin/openssl pkcs12 -export -in $CERT -inkey $KEY -CAfile $CHAIN -out $BUNDLE -caname root -name eap -chain -passout pass:$PASSWORD

# Create a new keystore with the PKCS12 bundle
/usr/bin/keytool -importkeystore -storetype PKCS12 -srcstoretype PKCS12 -srckeystore $BUNDLE -srcstorepass $PASSWORD -destkeystore $KEYSTORE -destkeypass $PASSWORD -deststorepass $PASSWORD

# remove the PKCS12 bundle
rm $BUNDLE

# deploy the new keystore
mv $KEYSTORE /opt/tplink/EAPController/data/keystore/eap.keystore
cp $CERT /opt/tplink/EAPController/data/keystore/eap.cer

# Restart the controller
/usr/bin/systemctl restart omada

  @ragejage 

Quick update: I have fixed up the code to handle PEM, PFX and JKS files (all the current options in the UI). I have a pull request open to push the code back to the original author's repo, but my local repo will work in the meantime.

I successfully have the upload program connected to my certbot renewal hooks and have it updating regularly.

  @peterdeg 

For me on OPNsense:

I created a cert for 10 years, imported on controller.

Done, well at least for now it seems....