Self-signed SSL certificate for the INSTAR MQTT Broker

OpenSSL
Broker Certificate and Client Public Key
- broker.pem
- client.pem
Adding the Certificate to your Cameras
Testing the MQTT Network
- MQTT.fx

Q: How do I create a custom SSL certificate for the INSTAR MQTT Broker under Windows 10?

A: To create a self-signed certificate on Windows 10 we first have to install OpenSSL.

OpenSSL

You can download a Win32 distribution of OpenSSL here. You might also need C++ re-distributable files if you want to use OpenSSL which can be obtained at this link.

Now open a command prompt as ADMINISTRATOR:

Windows Self-Signed Cert for INSTAR MQTT Broker

And change into the OpenSSL\bin directory - e.g. cd \Program Files\OpenSSL-Win64\bin for the 64bit version of OpenSSL. Here we can now use the OpenSSL command to create a certificate for our camera - Note that you have to add your camera's IP address (or domain - if you have those assigned inside your local network) to this command.

openssl req -x509 -nodes -subj "/CN=192.168.2.117" -newkey rsa:2048 -keyout private-key.pem -out cert.pem -days 365

Windows Self-Signed Cert for INSTAR MQTT Broker

This command creates a private and public key (certificate) for the camera with the IP address 192.168.2.117 - this is the IP address of the camera that we want to use as our MQTT Broker. Please change this IP address to the IP of your own camera. You will find the two files inside the OpenSSL /bin directory - private-key.pem and cert.pem:

Windows Self-Signed Cert for INSTAR MQTT Broker

Broker Certificate and Client Public Key

Our broker camera - in my case the 192.168.2.117 will need both - the private and the public key. Open both files and copy the content of private-key.pem at the end of cert.pem. Save this new file with the name broker.pem. The result will look something like this:

broker.pem

client.pem

Every client you want to connect to your broker - e.g. a second camera - will only need the public key from cert.pem. Open this file and save it as client.pem:

Adding the Certificate to your Cameras

Now upload the broker.pem file to your broker camera via the SSL Menu:

Windows Self-Signed Cert

Now make sure that the custom certificate is activated and restart your camera:

Windows Self-Signed Cert

Switch over to the camera you want to connect to your broker as a client and upload the client.pem file via the MQTT Menu:

Windows Self-Signed Cert

The MQTT configuration of your two cameras should now look like this (substitute the IP addresses with the IPs of your cameras):

Windows Self-Signed Cert

You can now continue adding all your remaining INSTAR Full HD cameras to your broker camera the same way.

Testing the MQTT Network

To check if the connection was successful you can check the MQTT log on each camera under /tmpfs/mqtt-log:

Windows Self-Signed Cert

The broker camera should show you that it is connected to the local MQTT broker 127.0.0.1 via your non-SSL port (default 1883):

[Info] Translations loaded: 266
[Info] Initalize Mqtt
[Info] Authenticate with Mqtt-Broker
[Info] Connect to Mqtt-Broker 127.0.0.1 on port 1883...
[Info] Initialize Fifo-Watcher
[Warning] A file at the fifo filepath already exists, delete file and retry!
[Info] Start Fifo-Watcher-Thread
[Info] Start listening...
[Info] Open fifo
[Info] Synchronize Cgi-Server with Mqtt-Broker

And your client cameras should be connected to the IP address of your broker camera (in my case 192.168.2.117) via the SSL port (default) 8883 with activated TLS:

[Info] Translations loaded: 266
[Info] Initalize Mqtt
[Info] Authenticate with Mqtt-Broker
[Info] Activate TLS
[Info] Connect to Mqtt-Broker 192.168.2.117 on port 8883...
[Info] Initialize Fifo-Watcher
[Warning] A file at the fifo filepath already exists, delete file and retry!
[Info] Start Fifo-Watcher-Thread
[Info] Start listening...
[Info] Open fifo
[Info] Synchronize Cgi-Server with Mqtt-Broker

The last entry [Info] Synchronize Cgi-Server with Mqtt-Broker shows you that the connection was successful and all retained MQTT Topics have been published to your MQTT broker. If this is missing something with the SSL connection went wrong.

MQTT.fx

You can now connect a program like MQTT.fx to your broker to try sending commands to all cameras on your MQTT network:

Windows Self-Signed Cert

Note that you also have to use the client.pem file to connect to the network by SSL - the same file you uploaded to all client cameras!

Subscribe to the wildcard topic # - you should see the retained messages from all your connected cameras:

Windows Self-Signed Cert

FAQs