Configuration: Setting up SSL

About

The free version of Agent DVR is great for local connections using HTTP. But, when you're stepping out into the world of remote connections, security is key, and that's where SSL comes in. Want a secure remote connection to your Agent DVR? Simply use our remote web portal for a safe and secure experience.

Important: Setting up SSL, DNS, and port forwarding can get a bit tricky, and we can't guarantee it'll work reliably on all networks. We recommend sticking with using our remote web portal for remote access. You'll still need a computer running Agent that's connected to your cameras but you won't need to mess around with anything else.

Pro Tip: Once you've got SSL and DNS up and running, you can access your Agent DVR from your mobile device and add it as an app through your browser's tool menu.

SSL on Windows

Agent DVR now terminates SSL itself, so all you need is a PKCS#12 certificate file (a .p12 or .pfx) that contains the private key. You no longer need to install the certificate into Windows or bind it with netsh.

Option 1 - quick self-signed certificate (for testing): run this in PowerShell to create a certificate for localhost and export it to a .p12 (change the password to suit):

$cert = New-SelfSignedCertificate -DnsName "localhost" -CertStoreLocation "Cert:\CurrentUser\My" -NotAfter (Get-Date).AddYears(5)
$pwd = ConvertTo-SecureString -String "yourpassword" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath "C:\Agent\certificate.p12" -Password $pwd

For a public hostname use -DnsName "youragentserver.ddns.net" instead of localhost.

Option 2 - real certificate (Let's Encrypt): follow the letsencrypt instructions , then convert the generated .pem files to a .p12 with openssl:

openssl pkcs12 -export -out C:\Certbot\live\youragentserver.ddns.net\certificate.p12 -inkey C:\Certbot\live\youragentserver.ddns.net\privkey.pem -in C:\Certbot\live\youragentserver.ddns.net\fullchain.pem

Open Agent DVR, click the Server icon – Settings – Local Server tab and set:

  • SSL Port: the port to serve HTTPS on, e.g. 8443 (or 443 for the standard HTTPS port).
  • SSL Certificate: the full path to your .p12 file, e.g. C:\Agent\certificate.p12
  • SSL Password: the password you set when creating the certificate.

Click OK. Agent restarts the local server automatically – watch the log for Accepting SSL connections at https://.... You can now load the UI at https://your.server.address:8443. Be sure to use https:// – browsing with http:// to the SSL port returns an empty response.

A self-signed certificate (Option 1) is not trusted by browsers, so the first time you visit you will see a privacy warning. Click Advanced then Continue to localhost (unsafe) to proceed – this is expected for self-signed certificates. A real certificate (Option 2) will not show the warning.

SSL on Linux / macOS

Agent DVR terminates SSL itself from a PKCS#12 certificate file (a .p12 or .pfx) that contains the private key.

Quick self-signed certificate (for testing):

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 1825 -nodes -subj "/CN=localhost"
openssl pkcs12 -export -out certificate.p12 -inkey key.pem -in cert.pem -passout pass:yourpassword

Real certificate (Let's Encrypt): follow the letsencrypt instructions , then convert the generated .pem files to a .p12 (run from the folder your certificate was saved to):

openssl pkcs12 -export -out certificate.p12 -inkey privkey.pem -in fullchain.pem

In Agent DVR's local UI click the Server icon, Server Settings, Local Server tab, then set SSL Port, SSL Certificate (the full path to your .p12 file) and SSL Password, and click OK. Agent restarts the local server automatically and you can load the UI at https://your.server.address:8443 (use https://).

On Linux, ports below 1024 (including the standard HTTPS port 443) require root. Agent DVR installed as a service runs as root, so 443 works; if you run it manually as a normal user choose a high port such as 8443.
Make sure the certificate file is readable by the Agent process – if needed run 
chmod 644 certificate.p12
A self-signed certificate triggers a browser privacy warning the first time (click Advanced then proceed); a real certificate will not.