Self-signed SSL certificate for the INSTAR MQTT Broker

OpenSSL
Broker Certificate and Client Public Key
- broker.pem
- client.pem
Adding the Certificate to your Cameras
Testing the MQTT Network
- MQTT.fx

Q: How do I create a custom SSL certificate for the INSTAR MQTT Broker under Windows 10?

Mike Polinowski

INSTAR MQTT

Firmware Update

Full HD Series

May 10th, 2021

INSTAR Deutschland GmbH
INSTAR MQTT
December 31st, 2019

Mike Polinowski

IFTTT Applets

Firmware Update

Full HD Series

INSTAR Cloud

September 9th, 2020

INSTAR Deutschland GmbH
INSTAR IFTTT Applets
October 19th, 2020

A: To create a self-signed certificate on Windows 10 we first have to install OpenSSL.

OpenSSL

You can download a Win32 distribution of OpenSSL here. You might also need C++ re-distributable files if you want to use OpenSSL which can be obtained at this link.

Now open a command prompt as ADMINISTRATOR:

And change into the OpenSSL\bin directory - e.g. cd \Program Files\OpenSSL-Win64\bin for the 64bit version of OpenSSL. Here we can now use the OpenSSL command to create a certificate for our camera - Note that you have to add your camera's IP address (or domain - if you have those assigned inside your local network) to this command.

openssl req -x509 -nodes -subj "/CN=192.168.2.117" -newkey rsa:2048 -keyout private-key.pem -out cert.pem -days 365

This command creates a private and public key (certificate) for the camera with the IP address 192.168.2.117 - this is the IP address of the camera that we want to use as our MQTT Broker. Please change this IP address to the IP of your own camera. You will find the two files inside the OpenSSL /bin directory - private-key.pem and cert.pem:

Broker Certificate and Client Public Key

Our broker camera - in my case the 192.168.2.117 will need both - the private and the public key. Open both files and copy the content of private-key.pem at the end of cert.pem. Save this new file with the name broker.pem. The result will look something like this:

broker.pem

client.pem

Every client you want to connect to your broker - e.g. a second camera - will only need the public key from cert.pem. Open this file and save it as client.pem:

Adding the Certificate to your Cameras

Now upload the broker.pem file to your broker camera via the SSL Menu:

Now make sure that the custom certificate is activated and restart your camera:

Switch over to the camera you want to connect to your broker as a client and upload the client.pem file via the MQTT Menu:

The MQTT configuration of your two cameras should now look like this (substitute the IP addresses with the IPs of your cameras):

You can now continue adding all your remaining INSTAR Full HD cameras to your broker camera the same way.

Testing the MQTT Network

To check if the connection was successful you can check the MQTT log on each camera under /tmpfs/mqtt-log:

The broker camera should show you that it is connected to the local MQTT broker 127.0.0.1 via your non-SSL port (default 1883):

[Info] Translations loaded: 266
[Info] Initalize Mqtt
[Info] Authenticate with Mqtt-Broker
[Info] Connect to Mqtt-Broker 127.0.0.1 on port 1883...
[Info] Initialize Fifo-Watcher
[Warning] A file at the fifo filepath already exists, delete file and retry!
[Info] Start Fifo-Watcher-Thread
[Info] Start listening...
[Info] Open fifo
[Info] Synchronize Cgi-Server with Mqtt-Broker

And your client cameras should be connected to the IP address of your broker camera (in my case 192.168.2.117) via the SSL port (default) 8883 with activated TLS:

[Info] Translations loaded: 266
[Info] Initalize Mqtt
[Info] Authenticate with Mqtt-Broker
[Info] Activate TLS
[Info] Connect to Mqtt-Broker 192.168.2.117 on port 8883...
[Info] Initialize Fifo-Watcher
[Warning] A file at the fifo filepath already exists, delete file and retry!
[Info] Start Fifo-Watcher-Thread
[Info] Start listening...
[Info] Open fifo
[Info] Synchronize Cgi-Server with Mqtt-Broker

The last entry [Info] Synchronize Cgi-Server with Mqtt-Broker shows you that the connection was successful and all retained MQTT Topics have been published to your MQTT broker. If this is missing something with the SSL connection went wrong.