nginx reverse proxy for unifi controller, so you can put a real cert in front of it.

nginx include unifi.conf

# listen on port 80, and redirect to port 443

server {
  listen 10.0.0.131:80;

  server_name   unifi01.int.unixathome.org;

  error_log  /var/log/nginx-unifi01.int.unixathome.org.error.log  info;
  access_log /var/log/nginx-unifi01.int.unixathome.org.access.log combined;

  return 301 https://$server_name$request_uri;
}



server {
  listen 10.55.0.131:443 ssl http2;

  server_name unifi01.int.unixathome.org;

  client_max_body_size 50m;

  root /usr/local/www/unifi01.int.unixathome.org;

  error_log  /var/log/nginx-unifi01.int.unixathome.org.error.log  info;
  access_log /var/log/nginx-unifi01.int.unixathome.org.access.log combined;

  ssl_certificate     /usr/local/etc/ssl/unifi01.int.unixathome.org.fullchain.cer;
  ssl_certificate_key /usr/local/etc/ssl/unifi01.int.unixathome.org.key;

  location  /  {
    proxy_pass      https://unifi01.int.unixathome.org:8443/;
    proxy_redirect  https://unifi01.int.unixathome.org:8443/ /;
    proxy_buffering off;

    proxy_read_timeout 60s;

    # May not need or want to set Host. Should default to the above hostname.
    proxy_set_header          Host            $host;
    proxy_set_header          X-Real-IP       $remote_addr;
    proxy_set_header          X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
  }
}