Enable encryption

Enable encryption to and from the management server

You can encrypt the two-way connection between the management server and the recording server or other remote servers with the data collector (Event Server, Log Server, LPR Server, and Mobile Server).

If your system contains multiple recording servers or remote servers, you must enable encryption on all of them. For more information, see Management server encryption (explained).

  • A server authentication certificate is trusted on the computer that hosts the management server

First, enable encryption on the management server.

Steps:

  1. On the computer that runs the management server, right-click the Management Server Manager icon in the notification area and select Server Configurator.

    The Server Configurator window appears. The options in this window depend on what servers are installed on the computer.

  2. Under Server certificate, turn on encryption and select the certificate to encrypt communication between the recording server, management server and data collector server.

    When you select a certificate, a list appears with unique subject names of certificates installed on the local computer in the Windows Certificate Store that has a private key.

    Select Details to view Windows Certificate Store information about the selected certificate.


  3. Click Apply.

To complete the enabling of encryption, the next step is to update the encryption settings on each recording server and each server with a data collector (Event Server, Log Server, LPR Server, and Mobile Server). For more information, see Enable server encryption for recording servers or remote servers.

Enable server encryption for recording servers or remote servers

You can encrypt the two-way connection between the management server and the recording server or other remote servers with the data collector (Event Server, Log Server, LPR Server, and Mobile Server).

If your system contains multiple recording servers or remote servers, you must enable encryption on all of them. For more information, see Encryption from the management server to the recording server (explained) and Encryption between the management server and the Data Collector Server (explained).

Steps:

  1. On each computer that runs a recording server or remote server with a data collector, open the Server Configuratorfrom the Windows startup menu.

    The options in this window depend on what servers are installed on the computer.

  2. In the Server Configurator, under Server certificate, turn on encryption and select the certificate to encrypt communication between the recording server, management server and data collector server.

    When you select a certificate, a list appears with unique subject names of certificates installed on the local computer in the Windows Certificate Store that has a private key.

    The recording server service user has been given access to the private key. It is required that this certificate is trusted on all clients.

    Select Details to view Windows Certificate Store information about the selected certificate.


  3. Click Apply.

When you apply certificates, the recording server will be stopped and restarted. Stopping the Recording Server service means that you cannot record and view live video while you are verifying or changing the recording server's basic configuration.

Enable encryption to clients and servers

You can encrypt connections from the recording server to clients and servers that stream data from the recording server. For more information, see Encryption to clients and servers that retrieve data from the recording server (explained).

  • The server authentication certificate to be used is trusted on all computers running services that retrieve data streams from the recording server
  • XProtect Smart Client and all services that retrieve data streams from the recording server must be version 2019 R1 or later
  • Some third-party solutions created using MIP SDK versions earlier than 2019 R1 may need to be updated

Steps:

  1. On each computer that runs a recording server or remote server with a data collector, open the Server Configurator from the Windows startup menu.

    The options in this window depend on what servers are installed on the computer.

  2. In the Server Configurator, under Streaming media certificate, turn on encryption and select the certificate to encrypt communication between the clients and servers that retrieve data streams from the recording server.

    When you select a certificate, a list appears with unique subject names of certificates installed on the local computer in the Windows Certificate Store that has a private key.

    The recording server service user has been given access to the private key. It is required that this certificate is trusted on all clients.

    Select Details to view Windows Certificate Store information about the selected certificate.


  3. Click Apply.

When you apply certificates, the recording server will be stopped and restarted. Stopping the Recording Server service means that you cannot record and view live video while you are verifying or changing the recording server's basic configuration.

To verify if the recording server uses encryption, see View encryption status to clients.

Enable encryption on the mobile server

To use an HTTPS protocol for establishing secure connection between the mobile server and clients and services, you must apply a valid certificate on the server. The certificate confirms that the certificate holder is authorized to establish secure connections. For more information, see Mobile server data encryption (explained) and Mobile server encryption requirements for clients.

Certificates issued by CA (Certificate Authority) have a chain of certificates and on the root of that chain is the CA root certificate. When a device or browser sees this certificate, it compares its root certificate with pre-installed ones on the OS (Android, iOS, Windows, etc.). If the root certificate is listed in the pre-installed certificates list, then the OS ensures the user that the connection to the server is secure enough. These certificates are issued for a domain name and are not free of charge.

To enable encryption, after the mobile server has been installed:

  1. On a computer with a mobile server installed, right-click the Mobile Server Manager tray icon in the taskbar of the operating system and select Edit certificate.
  2. Select the Encrypt the connections for clients and services that retrieve data streams from the mobile server check box.
  3. To select a valid certificate, click . A Windows Security dialog box opens.
  4. Select the certificate that you want to apply.
  5. Click OK.

Edit certificate

If the certificate that you use for secure connection has expired, you can select another certificate that is installed on the computer on which the mobile server is running.

To change a certificate:

  1. On a computer with a mobile server installed, right-click the Mobile Server Manager tray icon in the taskbar of the operating system and select Edit certificate.
  2. To select a valid certificate, click . A Windows Security dialog box opens.
  3. Select the certificate that you want to apply.
  4. Click OK.

    5. A message informs you that the certificate has been installed and that the Mobile Server service has been restarted to apply the change.