Source fact: The AXIS Device Manager Security Guide describes certificate lifecycle management as the continuing work of issuing, installing, inspecting, remediating, monitoring, and renewing certificates. AXIS Device Manager can manage HTTPS and IEEE 802.1X certificates, monitor expiration, and renew certificates before they expire.
\nThe roles are different. For HTTPS, a camera presents a server certificate and the connecting client validates it. Axis notes that in a common VMS architecture, the VMS server accesses cameras directly while operator clients receive live and recorded video through the VMS. In that scenario, the VMS trust store is central, though maintenance clients that connect directly also need the appropriate trust.
\nFor 802.1X, the camera uses a client certificate to authenticate itself to a RADIUS service before network access is allowed. Axis explains that an 802.1X environment typically requires managed switches, RADIUS infrastructure, a certificate authority, and staff to maintain and monitor it. The guide describes separate workflows for HTTPS server certificates and 802.1X client and authentication certificates.
\n\nAxis discusses using AXIS Device Manager as a private CA for private camera resources and using an enterprise-PKI intermediate CA for 802.1X. That recommendation belongs to the architecture described in the guide. It should not be generalized to public services, every enterprise PKI, or a design in which many clients connect directly to cameras.
\nAn expired, untrusted, incorrectly named, or unavailable certificate can break management, recording, or network admission. Renewal is therefore a production change. The source does not authorize replacing certificates without validating the VMS, RADIUS, switch, device, time, and recovery dependencies.
\n\nDSE recommendation: This is DSE operational synthesis for Axis environments, not a universal PKI design.
\n