ACME https edge integration

[Xavantex]

Greetings AXIS and community,

I am in the process of encrypting my internal network, I have myself deployed a self-hosted Certificate Authority with ACME (Automatic Certificate Management Environment) capabilities.
A while ago I set up an AXIS camera, however, I did not particulary enjoy any of the given solutions for certificate renewal.
With the release of ACME as a standardized protocol, wouldn't it be a great opportunity to offload renewal and registration to the edge, then each camera is in charge of updating it's own certificate, this would also make short-term certificates more viable, no?

I would love some comments or thoughts on this. I have tried to search through documentation, tech support, and forums to no avail as to wether or not anyone has already done this.

Cheers,

X

[github-actions[bot]]

This automatically generated reply acts as a friendly reminder.

Answers to your questions will most often come from the community, from developers like yourself. You will, from time to time, find that Axis employees answers some of the questions, but this is not a guarantee. Think of the discussion forum as a complement to other support channels, not a replacement to any of them.

If your question remains unanswered for a period of time, please revisit it to see whether it can be improved by following the guidelines listed in Axis support guidelines.

[vivekatoffice]

Hi @Xavantex ,
Thank you for sharing your experience with Axis camera and Automated Certificate Management Environment protocol (ACME) (Learned something new ❇️ 😄 )

As per my understanding, its good solution to deploy as ACAP running inside Axis devices.

[Xavantex]

Maybe. Tried to figure out how the basic .crt file is used. Seems to be a bit too dynamic to easily be used with a third-party app, since you do offer certificate updates with the built-in ca from the AXIS device manager. Otherwise, yes ACAP seems like a good initial step.
I would have thought though that the major audience for this kind of integration would be businesses, for the scalable management of TLS certificates, but maybe it's more streamlined to rely on your integrated CA device managers being secure.