ONVIF TLS Configuration Add-on v1.0: manage the transition without guessing

What version 1.0 establishes

Source fact: The ONVIF TLS Configuration Add-on provides a standardized way for a conformant client to perform the initial configuration and later update of TLS settings on a conformant device. It addresses encrypted communication between ONVIF clients and devices using Transport Layer Security.

Support is required on both sides. A client with the add-on can configure a device only when that device supports the same add-on. The version 1.0 specification, dated December 2023, also states that ONVIF Network Interface Specifications version 22.06 or later are required for conformance.

ONVIF’s current lifecycle notice says the last date for product conformance submissions for version 1.0 is March 31, 2027. The page says version 2.0 is scheduled for early 2027 to replace it. As of this review, that is schedule information, not a final version 2.0 specification or a confirmed product capability. Procurement and migration decisions should not invent requirements for an unpublished final release.

What the add-on does not prove

Add-on conformance does not establish that every physical-security protocol or media stream is encrypted. It does not validate an organization’s certificate authority, trust-store distribution, certificate names, renewal process, cipher policy, or operational response to expiration. Those outcomes depend on product implementation, configuration, client/device compatibility, and the wider architecture.

A product’s general TLS capability is also not the same as an official add-on claim. Exact model and firmware or software records should be checked in ONVIF’s database. Version 1.0 deployments remain real systems to manage; the submission deadline does not itself disable them.

DSE transition checklist

DSE recommendation: This is DSE operational synthesis. It does not predict the content or release date of version 2.0.

Inventory each client and device, exact firmware or software, claimed add-on version, and official database record.

Map which control, event, configuration, and media paths actually use TLS and which do not.

Record certificate issuer, subject names, trust stores, expiry, renewal owner, and recovery access.

Ask manufacturers for documented support and transition plans; separate commitments from roadmaps.

Test initial configuration, renewal, expired or untrusted certificates, reconnect behavior, and client compatibility in a lab.

Avoid specifying version 2.0 details until ONVIF publishes a final specification and conformant products are listed.

Review ONVIF and manufacturer notices on a defined cadence and update the plan when evidence changes.

Official references

TLS Configuration Add-on — current purpose and lifecycle notice.

TLS Configuration Add-on Specification v1.0 — December 2023 requirements.

Conformant Products — authoritative product, version, profile, and add-on claims.