CameraStack TLS Manager configures and checks HTTPS on ONVIF cameras. It can manage a simple self-signed certificate, enrol a camera-held key with your certificate authority, verify secure media transports, and clean up unused objects created by CameraStack TLS tools.
The application never exports a camera private key. It keeps HTTP enabled while setting up or rotating a certificate. Disabling HTTP is a separate action with its own confirmation and recovery checks.
Start here
- Choose Discover cameras, then select the camera. You can also enter its ONVIF device-service URL.
- Enter an administrator username and password in the fixed left panel.
- Choose Inspect TLS. Inspection reads the current state and changes nothing.
- Pick the flow below that matches the inspection result.
Key generation can be slow on camera processors. Key wait (seconds) defaults to 180. Increase it if the camera is known to take longer. Every desktop action has an overall five-minute safety limit.
Self-signed certificate flow
Use Self-signed setup for a camera network where clients accept an exact certificate pin instead of relying on a certificate authority.
Camera has no active TLS assignment
- Leave Common name blank to use the selected camera name or address, or enter the stable DNS name clients use.
- Add every stable DNS name and IP address clients use.
- Choose Create, renew, or verify.
- Check and accept the displayed SHA-256 fingerprint.
The key remains on the camera. The manager checks the returned certificate, assigns it, enables HTTPS, and proves that HTTPS presents that exact certificate.
Camera already has one self-signed certificate
Use the same Create, renew, or verify action. It works regardless of which tool or administrator created the existing certificate.
- A healthy certificate outside the renewal window is verified without changing camera protocol settings.
- A certificate near expiry, expired, not yet valid, too weak, or using the wrong identity is replaced atomically.
- Select Replace the active self-signed certificate now for immediate renewal.
- Leave the Common name and SAN fields empty to preserve the existing identity details while also requesting the currently selected camera address.
Some cameras ignore requested subject alternative names. The default mode shows a compatibility warning when the common name still matches. Select Reject cameras that omit requested SANs when that behaviour is not acceptable.
Adopt current certificate
Adopt current certificate does not create, replace, assign, or enable anything. It verifies the certificate already presented by HTTPS, asks you to confirm its fingerprint, then stores that public certificate as the manager’s exact pin. Use it when another tool has already configured the camera.
Certificate authority enrolment
Use CA enrollment and rotation when clients should trust the camera through an organisational or private certificate authority.
- Enter the requested common name and SANs.
- Choose where to save the public CSR. The enrolment journal is stored in the operating system’s application data folder by default.
- Choose Create key and CSR.
- Give the CSR to your CA. Keep the journal on this workstation.
- When the CA returns the certificate, select the journal and a leaf-first PEM bundle.
- Choose Validate, activate, and verify and confirm the fingerprint.
The journal contains no password and no private key. It records enough non-secret state to resume an interrupted enrolment. TLS Manager detects an unfinished default journal when it starts.
Verify secure transports
The Verify tab checks what the camera advertises, including authenticated ONVIF over HTTPS, certificate name and validity, workstation trust or exact pin, snapshots, secure RTSP variants, WebSocket transport, and supported TLS versions. An unsupported optional transport is reported separately from a failure.
The support ZIP contains a sanitised JSON report and text summary. It should not contain passwords, authentication headers, certificates, or media payloads.
Disable plaintext HTTP
Run Verify secure transports first. Disable plaintext HTTP becomes safe only when the secure management checks pass. The manager repeats the preflight, sends the change through verified HTTPS, waits for HTTPS to return, confirms the camera reports HTTP disabled, and requires three consecutive refusals from the old HTTP TCP port.
Do not use this action unless every management client can reach the camera over HTTPS and you have an out-of-band recovery method.
Cleanup and recovery
Preview cleanup lists unused paths, certificates, and keys carrying aliases used by either CameraStack TLS tool. Assigned objects and unrelated vendor or administrator objects are excluded. The preview is checked again immediately before deletion.
Remove every TLS server assignment is a recovery flow for starting again. It is available only through an enabled HTTP connection. It disables HTTPS, confirms recovery over HTTP, removes the assignments, and retains certificate objects for inspection or later cleanup.
Prefer normal atomic renewal when one active assignment is usable.
Files and local secrets
- Passwords and accepted certificate pins are stored through the operating system credential vault when available.
- Enrolment journals are owner-only files in the application data folder by default.
- Exported public certificates and CSRs may be shared. TLS Manager atomically replaces regular output files and refuses symlink destinations.
- The camera private key is never written to this computer.
Support
When reporting a problem, include the application version, camera manufacturer, model and firmware, the action attempted, and a freshly generated sanitised support ZIP. Do not send camera passwords.