Camera certificate lifecycle management: HTTPS and 802.1X are different jobs

Two certificate purposes

Source fact: The AXIS Device Manager Security Guide describes certificate lifecycle management as the continuing work of issuing, installing, inspecting, remediating, monitoring, and renewing certificates. AXIS Device Manager can manage HTTPS and IEEE 802.1X certificates, monitor expiration, and renew certificates before they expire.

The roles are different. For HTTPS, a camera presents a server certificate and the connecting client validates it. Axis notes that in a common VMS architecture, the VMS server accesses cameras directly while operator clients receive live and recorded video through the VMS. In that scenario, the VMS trust store is central, though maintenance clients that connect directly also need the appropriate trust.

For 802.1X, the camera uses a client certificate to authenticate itself to a RADIUS service before network access is allowed. Axis explains that an 802.1X environment typically requires managed switches, RADIUS infrastructure, a certificate authority, and staff to maintain and monitor it. The guide describes separate workflows for HTTPS server certificates and 802.1X client and authentication certificates.

Architecture determines the CA choice

Axis discusses using AXIS Device Manager as a private CA for private camera resources and using an enterprise-PKI intermediate CA for 802.1X. That recommendation belongs to the architecture described in the guide. It should not be generalized to public services, every enterprise PKI, or a design in which many clients connect directly to cameras.

An expired, untrusted, incorrectly named, or unavailable certificate can break management, recording, or network admission. Renewal is therefore a production change. The source does not authorize replacing certificates without validating the VMS, RADIUS, switch, device, time, and recovery dependencies.

DSE lifecycle checklist

DSE recommendation: This is DSE operational synthesis for Axis environments, not a universal PKI design.

1. Inventory every certificate by device, purpose, issuer, subject, serial number, expiry, key location, and renewal owner.
2. Separate HTTPS server identity from 802.1X client authentication and any MQTT or syslog certificates.
3. Map which VMS, browser, management client, RADIUS server, and switch trusts which CA.
4. Protect CA private keys and backups according to the organization’s approved key-management process.
5. Set warnings early enough to investigate and stage renewal before expiration.
6. Test representative certificate issuance, installation, trust, 802.1X admission, VMS recording, and direct maintenance access.
7. Test expired, revoked, untrusted, or failed-renewal behavior and document an authorized recovery path.
8. Review the inventory after device replacement, CA change, network redesign, or VMS migration.

Official references

• AXIS Device Manager Security Guide — certificate lifecycle, HTTPS, 802.1X, CA, RADIUS, and trust guidance.
• AXIS OS Knowledge Base — current device certificate behavior and version-specific administration context.