Using Your Own Certificate for the Web Server
This setup guide describes how to upload your own web server certificate to the Behnke Station and switch access to the web interface to a secure connection.
The web interface can be accessed via HTTP (unsecured connection) or HTTPS (secured connection). To avoid security risks, the use of HTTPS is recommended. By default, no custom certificate is uploaded (the Behnke Station then uses its internal certificate). Because this certificate is not known to the browsers accessing the station, they display a certificate warning when accessing it via HTTPS.
With your own web server certificate issued by a certification authority that is trusted in your network, this warning no longer appears.
Note
As long as the web interface is accessed via HTTP, the login page indicates under SECURITY NOTICE that the connection is not secured, and offers the Use secure connection button.
Note
As long as the web interface is accessed via HTTP, the login page indicates under SECURITY NOTICE that the connection is not secured, and offers the Use secure connection button.
It is assumed that the Behnke-Station is already set up to the extent that access to the web interface is possible. If this is not the case, please follow the instructions provided with your base electronics (manualsThis page carries no version. This notice is generated automatically and was not written by an editor.) and refer to the technical manualRecently updated — within the last 72 hoursThis page carries no version. This notice is generated automatically and was not written by an editor. to complete the basic setup.
1. Requirements for the Certificate File
The Behnke Station expects the web server certificate in PEM format. You need one file that contains exactly one certificate with an unencrypted private key.
- exactly one certificate per file (no certificate chains with multiple certificates)
- the private key is in the same file
- the private key must not be encrypted with a passphrase
Caution
The file contains the private key in plain text. Treat it as confidential and do not transmit it over insecure channels.
Tip
Issue the certificate for the name under which the Behnke Station will later be accessed. If you access the station via its IP address, this must be included in the certificate (otherwise the browser will show a warning about a mismatched name despite the custom certificate).
2. Uploading the Certificate
- Open your browser
- Go to the web interface of the Behnke Station
- Log in
- Click the menu item in the sidebar on the left
- Navigate to the Web interface section
In the Web server certificate row, the Behnke Station shows the current status. Without a custom certificate, it says not uploaded and internal certificate is used.
- For the Certificate option, click upload
- The file selection dialog of your browser opens
- Select the prepared PEM file
After the upload, the information about the certificate is displayed above in the Web server certificate row. Check there whether the expected certificate was accepted.
- Click to save the configuration
3. Setting Access to the Web Interface
With the Access to the web interface option in the Web interface section, you specify whether the web interface can also be reached via HTTP in addition to HTTPS.
| Value | Meaning |
|---|---|
| HTTP allowed | The web interface can be reached via HTTP and via HTTPS. This is the default. |
| HTTP allowed if no certificate | HTTP is only allowed as long as no custom certificate is uploaded. Once a certificate is present, the web interface can only be reached via HTTPS. |
| Use HTTPS | The web interface can only be reached via HTTPS. |
- Set the Access to the web interface option to the desired value
- Click to save the configuration
Note
Access via HTTPS is always possible. This option only controls whether access via HTTP is additionally allowed. You therefore cannot lock yourself out by disabling HTTP.
Note
The option does not affect the retrieval of images or video streams. These can still be retrieved via HTTP, even if HTTPS must be used for the web interface.
4. HTTPS Security
Access via HTTPS uses TLS with various encryption methods. With the HTTPS security option, you specify which methods are permitted.
| Value | Meaning |
|---|---|
| Standard encryption | At least TLS 1.2 |
| Stronger encryption | At least TLS 1.2 |
| Strongest encryption | At least TLS 1.3 |
- Set the HTTPS security option to the desired value
- Click to save the configuration
Warning
Stronger encryption increases security, but may mean that HTTPS access is no longer possible with older web browsers. After changing the setting, check that the web interface can still be accessed with all browsers in use.
5. Removing the Certificate
- In the Certificate row, click remove
- Click to save the configuration
The Behnke Station then uses its internal certificate again. The Web server certificate row then again shows not uploaded.
Warning
If the Access to the web interface option is set to Use HTTPS, the web interface remains reachable only via HTTPS even after removal (then again with the internal certificate and the corresponding certificate warning from the browser).
6. FAQ
Note
The browser shows a warning despite a custom certificate
Check two points:
- Is the issuing certification authority entered as trusted on the computer you are accessing from?
- Does the name or IP address you use to access the Behnke Station match the certificate?
If either of the two does not match, the browser warns regardless of the fact that a custom certificate was uploaded.
Note
How can I tell whether my certificate is active?
In the Web interface section, in the Web server certificate row. Without a custom certificate, it says not uploaded and internal certificate is used; otherwise it shows the information about the uploaded certificate.
Note
The file is not accepted
The Behnke Station requires exactly one PEM file with exactly one certificate and an unencrypted private key. Common causes are a key file encrypted with a passphrase, a file with a complete certificate chain, or separate files for the certificate and the key.
Note
Are video streams also transmitted via HTTPS?
No. The Access to the web interface option does not affect the retrieval of images or video streams. These can still be retrieved via HTTP, even if HTTPS must be used for the web interface.
Note
Does the certificate also apply to other functions of the Behnke Station?
No. The web server certificate applies exclusively to access to the web interface. Certificates for other functions are configured separately, for example under for SIP or under for port authentication, see Port Authentication 802.1x via EAP-TLSThis page carries no version. This notice is generated automatically and was not written by an editor..