Axis Communications
Installing certificates via vapix api? #631
-
|
Has anyone successfully uploaded and installed a CA, server and private keys, or 802.1x certs via the vapix API? I am able to upload and install CA cert, even delete a cert. But unable to do anything else. Was wondering if someone has tried this, or even better, has some python code that works? The vapix documentations shows xml / soap with certificate payloads. See: https://www.axis.com/vapix-library/subjects/T10175981/section/t10161277/display Bottle of the finest pink champagne to the person with the best solution! |
Beta Was this translation helpful? Give feedback.
Replies: 9 comments 39 replies
-
|
This automatically generated reply acts as a friendly reminder. Answers to your questions will most often come from the community, from developers like yourself. You will, from time to time, find that Axis employees answers some of the questions, but this is not a guarantee. Think of the discussion forum as a complement to other support channels, not a replacement to any of them. If your question remains unanswered for a period of time, please revisit it to see whether it can be improved by following the guidelines listed in Axis support guidelines. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @wiener-dog , |
Beta Was this translation helpful? Give feedback.
-
|
Hello there. In this example, they are doing a soap call, with the CA cert as payload. That, I can actually get to work. BUT... the dam server and private key certs, don't work. That's the one I'm banging my head on. I don't know why it would be any different, but seems to be. I notice in this example, they set 2 header settings, the second being --header "SOAPAction:POST" I get it to work without using that. Doesn't help with the server and private key. Might just sftp the dam files over and manually tweak things via ansible.. or something else. Not in love with this api tbh. Sorry vivek, no pink champagne for you. yet. |
Beta Was this translation helpful? Give feedback.
-
|
If you can upload these certificates using the camera webpage, please give it a try yourself with Inspect network activity tool in the browser. This will help you to understand the correct payloads.
|
Beta Was this translation helpful? Give feedback.
-
|
omg, that is amazing. I had no idea this type of tool existed. That is the exact api call that isn't working. I believe vapix api is a bit fussy with indentation for the soap call. Thank you very much, this will help. |
Beta Was this translation helpful? Give feedback.
-
|
Hey @vivekatoffice have you ever tried and managed to get working this SOAP call? https://www.axis.com/vapix-library/subjects/t10175981/section/t10161277/display?section=t10161277-t10177052 I've made a lot of progress, this one has me stumped. This api call returns a "Invalid Certificate Configuration Fault". Not hugely helpful. as it could be one of many issues. I can get all the other calls working, but this one. |
Beta Was this translation helpful? Give feedback.
-
|
Oh i see that this call set the webserver supported chipers, i would just use same as camera use when you set this via ui |
Beta Was this translation helpful? Give feedback.
-
|
I am sure 5 minutes with dev tools and this Work ;) If Not just let me Know :) |
Beta Was this translation helpful? Give feedback.
-
|
I like the idea of devtools. But I'm on an enclave network. Basically a network where I can't move software to/and from easily. By the time I get the chrome plugin over and installed, I'll be a month behind. I have a guy going on site middle of next with with a ton of cameras to connect. 2000 miles away.. I NEED to be able to get this to work. You've given me an idea regarding matching the ciphers though. Hang on! |
Beta Was this translation helpful? Give feedback.
-
|
Its included, If you can Access the webui all is fine ;) |
Beta Was this translation helpful? Give feedback.
-
|
Dont worry i Help U, you would see tommorow this Works ;) |
Beta Was this translation helpful? Give feedback.
-
|
I did this for a year or so i got all things working but oh boy where code is i doent Know. ;) |
Beta Was this translation helpful? Give feedback.
-
Hi @wiener-dog ,
|
Beta Was this translation helpful? Give feedback.
-
|
@wiener-dog did you need help or does it work know? |
Beta Was this translation helpful? Give feedback.
-
|
That format soap call looks a hell of a lot like mine. Only diff is your acert:Id is certificate. I use the subject or CN of the cert. But still get the SOAP-ENV:Detailaweb:InvalidCertificateConfigurationFault" Its almost as if it wasn't happy with the certs / CA / private keys, and how they were installed. But I if I do a soap call to get the certs or CA's, it works fine, they are installed properly. If I go on the gui, I see the certs there, ready for me to set them to be used. Soooh close. |
Beta Was this translation helpful? Give feedback.
-
|
Also, I'm just using a curl from the linux shell. xmllint is fine with my xml formatting. SOAP format is right. You got me thinking about the ciphers though. I wonder if I'm missing one...? |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
If I use a soap call to get all the certificates, from the camera, I see all those Axis device pre-installed certs, as well as our own self signed cert. In our case, when we generate our own certs, we set the subject / Name to the serial number of the camera. So an openssl x509 ..... |grep CN clearly shows the subject CN is set properly. So from a fundamentals point of view, it looks like the certs are there, and ours is installed correctly. I can set it as active via the GUI. But obviously don't want to. |
Beta Was this translation helpful? Give feedback.
-
|
i determine the ciphers via param.cgi ;) so script do all stuff you just need the request module
|
Beta Was this translation helpful? Give feedback.
-
|
ok.....now your just showing off!!! Its a very difficult environment. This is why I'm just using plain old curl, and xml files. I'd love to use python. I used it a lot on my openstack work over the years. But its just not fully available. I hate how rhel ships with only basic modules. Thank you! for the cipher determination api call. I'll give it a go. |
Beta Was this translation helpful? Give feedback.
-
|
ok but with that we cant help gg doest the server also not have internet connection right ? otherwise you could do python3 get-pip.py (https://bootstrap.pypa.io/get-pip.py) |
Beta Was this translation helpful? Give feedback.
-
|
no internet server. So unpatched rhel and windows. That's all I have to work with. Now, your http://192.168.171.103/axis-cgi/admin/param.cgi?action=list&group=HTTPS call gave me the full list of supported/needed ciphers. I didn't know I was supposed to do that and use those ciphers. So I extracted all of the required ciphers, cut and paste them in, there are 8 of them. And now IT WORKS!! Pink champagne for you!!!! |
Beta Was this translation helpful? Give feedback.
-
|
glad to hear =) now its also safe when firmware updates change this cipers ;) |
Beta Was this translation helpful? Give feedback.
-
|
omg, I'm an idiot. I installed the 802.1X certificate for the webservice.... which has the wrong CN. So now the interface is borked... |
Beta Was this translation helpful? Give feedback.
-
|
austria =) ups, i see i work with my other gh account =) |
Beta Was this translation helpful? Give feedback.
-
|
Ok great. I need to document what I've done so far, get my code organized... And then this afternoon try to update the firmware. Aiming for 11.6!!! Tks |
Beta Was this translation helpful? Give feedback.
-
|
have fun =) |
Beta Was this translation helpful? Give feedback.
-
|
My wife just came back from vienna. Apparently the sacher torte is pretty good ! |
Beta Was this translation helpful? Give feedback.
-
|
hehe good stuff thats right |
Beta Was this translation helpful? Give feedback.
no internet server. So unpatched rhel and windows. That's all I have to work with.
Now, your http://192.168.171.103/axis-cgi/admin/param.cgi?action=list&group=HTTPS call gave me the full list of supported/needed ciphers. I didn't know I was supposed to do that and use those ciphers. So I extracted all of the required ciphers, cut and paste them in, there are 8 of them. And now IT WORKS!! Pink champagne for you!!!!