Axis Communications
Vapix LoadCACertificates works, but how to activate specific CA cert? #780
-
|
The vapix calls are great for deleting and adding CA certs. Works very well. But unable to enable or use a specific CA. Does the API have a way of setting a specific CA as "active" or "enabled". Vivek, you seem to literally know everything about these cameras. Love to hear your suggestion for this. Tks |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 3 replies
-
|
This automatically generated reply acts as a friendly reminder. Answers to your questions will most often come from the community, from developers like yourself. You will, from time to time, find that Axis employees answers some of the questions, but this is not a guarantee. Think of the discussion forum as a complement to other support channels, not a replacement to any of them. If your question remains unanswered for a period of time, please revisit it to see whether it can be improved by following the guidelines listed in Axis support guidelines. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @wiener-dog , In my understanding, specifying the CA cert is not required for Set HTTPS certificate
This means that the CAs uploaded to the Axis device are working as trusted CAs. This is what I captured using the Wireshark tool:
|
Beta Was this translation helpful? Give feedback.
-
|
The CA is for the 802.1x, on our setup, with our poe switches / radius servers, the cameras need the CA and the cert to auth on the network. I'm sorry, I should have stated that in m question. So, not HTTPS, but 802.1x. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @wiener-dog ,
<?xml version="1.0" encoding="UTF-8"?>
<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope">
<Header/>
<Body >
<SetDot1XConfiguration xmlns="http://www.onvif.org/ver10/device/wsdl" xmlns:tt="http://www.onvif.org/ver10/schema"><Dot1XConfiguration><tt:Dot1XConfigurationToken>EAPTLS_WIRED</tt:Dot1XConfigurationToken><tt:Identity>axis-b8XXXXXXXXXX</tt:Identity><tt:EAPMethod>13</tt:EAPMethod><tt:EAPMethodConfiguration><tt:TLSConfiguration><tt:CertificateID>Axis device ID RSA-2048 (802.1AR)</tt:CertificateID></tt:TLSConfiguration></tt:EAPMethodConfiguration><tt:CACertificateID>ca_MQTT</tt:CACertificateID></Dot1XConfiguration></SetDot1XConfiguration>
</Body>
</Envelope>
I agree with you about less information available for different options available. Hope you will be able to automate the complete process 😄 |
Beta Was this translation helpful? Give feedback.
-
|
OMG!!!! This is the missing magic sauce: tt:CACertificateIDca_MQTT</tt:CACertificateID> This isn't documented in the Dot1XConfiguration interface.. And it works perfectly. And I guess makes sense. THANK YOU! |
Beta Was this translation helpful? Give feedback.
-
|
And for the record, if you have firmware < 11.x, this routine doesn't work the same, or well, or at all. I have a couple hundred Q352x cameras running firmware 10.x that have expiring certs.... So will have to figure out when I can update the fw, before I can update the certs. this camera stuff which is new to me... full time job. :) |
Beta Was this translation helpful? Give feedback.
-
|
Please give it a try yourself with Inspect network activity tool in the browser. I usually find the correct API like this 😉 |
Beta Was this translation helpful? Give feedback.
-
|
Interesting. I gave it a go. Pretty complicated, but looks like the info is there if you can drill down. My biggest missing piece, as I said before was setting the original root password on brand new cameras. This we have to do from the device manager unfortunately. And not sure, but don't think the devtools can capture what the device manager is doing to set the root password. So I'm still out of luck on that front. Don't have wireshark, and can't get it. :( |
Beta Was this translation helpful? Give feedback.
Hi @wiener-dog ,
Thank you for the details.
It is the same APIs calls mentioned here: