You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@
34
34
The AXIS IP Camera Orchestrator extension remotely manages certificates on AXIS IP Network Cameras. This
35
35
orchestrator extension inventories certificates on the camera's certificate store, and it also supports adding new client-server certificates and adding/removing CA certificates.
36
36
New client-server certificates are created in the AXIS camera certificate store via On Device Key Generation (ODKG aka Reenrollment).
37
-
This means that certificates cannot be directly added to the Axis camera, but instead the keypair is generated on the AXIS device using a keystore and a certificate is issued for that keypair via a CSR submitted to Command for enrollment.
37
+
This means that certificates cannot be directly added to the AXIS camera, but instead the keypair is generated on the AXIS device and a certificate is issued for that keypair via a CSR submitted to Command for enrollment.
38
38
This workflow is completely automated in the AXIS IP Camera Orchestrator extension. CA certificates can be added to the camera from uploaded CA certificates in Command.
39
39
40
40
### Use Cases
@@ -51,7 +51,7 @@ The Axis IP Camera Orchestrator extension DOES NOT support the following use cas
51
51
1. Ability to remove client-server certificates from the camera
52
52
2. Ability to add client-server certificates to the camera
53
53
54
-
\* Currently supported certificate usages include: **HTTPS, IEEE802.X, MQTT**
54
+
\* Currently supported certificate usages include: **HTTPS**, **IEEE802.X**, **MQTT**, **Other**
55
55
56
56
57
57
@@ -273,10 +273,10 @@ These values must match or the session will be denied.
273
273
274
274
> [!IMPORTANT]
275
275
> You will want to replace the device ID certificate bound to the HTTP server with a CA-signed certificate. To do this,
276
-
> you will need to schedule a reenrollment job and select "HTTPS" as the Certificate Usage.
276
+
> you will need to schedule a Reenrollment job and select **HTTPS** as the Certificate Usage.
277
277
278
278
> [!IMPORTANT]
279
-
> After associating a CA-signed certificate with the HTTP server, you need to make sure the orchestrator server trusts the HTTPS certificate.
279
+
> After associating a CA-signed certificate with the HTTP server via the Reenrollment job, you need to make sure the orchestrator server trusts the HTTPS certificate.
280
280
> Therefore, you will need to install the full CA chain - including root and intermediate certificates - into the orchestrator server's local
281
281
> certificate store.
282
282
@@ -369,7 +369,7 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
369
369
### Certificate Usage
370
370
371
371
Every certificate inventoried will have an Entry Parameter called \`Certificate Usage\`.
372
-
There are four (4) possible options:
372
+
There are five (5) possible options:
373
373
374
374
***HTTPS**
375
375
***IEEE802.X**
@@ -384,8 +384,8 @@ There are four (4) possible options:
384
384
is presented to the 802.1x radius server for authentication.
385
385
3. MQTT
386
386
- This certificate usage describes the client certificate used to authenticate the camera to the MQTT broker.
387
-
In this scenario, the camera connects to the MQTT broker over SSL and performs a TLS handshake. If a client certificate is provided,
388
-
the camera presents this client certificate to the MQTT broker.
387
+
In this scenario, the camera connects to the MQTT broker over SSL and performs a TLS handshake.
388
+
The camera presents this client certificate to the MQTT broker.
389
389
4. Trust
390
390
- This certificate usage describes a public certificate issued by a CA used to establish trust.
391
391
5. Other
@@ -407,7 +407,7 @@ There are four (4) possible options:
407
407
408
408
## Caveats
409
409
410
-
> [!CAVEAT] Reenrollment jobs will not replace or remove a client-server certificate with the same alias. They will also not remove
410
+
> [!NOTE] Reenrollment jobs will not replace or remove a client-server certificate with the same alias. They will also not remove
411
411
> the original certificate if a particular \`Certificate Usage\` had an associated cert. Since the camera has limited storage,
412
412
> it will be up to the user to remove any unused client-server certificates via the AXIS Network Camera GUI.
0 commit comments