# Choose Axis external-device certificate validation deliberately > Review the documented off, standard and limited validation modes for Axis external-device connections. Keep certificate-name validation, installed trust material and protocol support explicit in the chosen mode. - Canonical URL: https://update.dsesecurity.com/updates/choose-axis-external-device-certificate-validation-deliberately/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-29T20:33:21+00:00 - Modified: 2026-10-29T20:33:34+00:00 - Last reviewed by DSE: 2026-10-29 - Resource type: Guide - DSE priority: Advisory - Topics: Cybersecurity, Video Surveillance - Reading time: 3 minutes ## What you need to know Review the documented off, standard and limited validation modes for Axis external-device connections. Keep certificate-name validation, installed trust material and protocol support explicit in the chosen mode. ## Potentially affected Axis products exposing the documented External IP Device Information interface; confirm actual device, hardware and software applicability before applying the proposed checks. ## DSE recommendation DSE recommends recording the selected validation mode with the external identity, protocol and approved trust references before changing connection settings. ## Article Bottom line: Choose a validation mode from the approved trust requirement. Do not weaken the mode merely to make an external camera connection succeed without recording which validation requirement was changed. ## Source fact: documented behavior Axis’s [External IP Device Information](https://developer.axis.com/vapix/network-video/external-ip-device-information/) stores information used to connect to an external data-streaming device, such as a camera. Its certvalidation description makes off the default and says this disables certificate validation. The source describes standard validation against installed CA certificates and limited validation with Common Name checking disabled; both require a protocol supporting validation. ## What the source does not establish Do not infer that these mode names qualify a certificate, authorize an unfamiliar CA or establish equivalent behavior in another API. Check the exact device and protocol. A stored connection entry is not proof of authenticated image delivery, recording continuity or compliance with a security policy. ## Applicability questions - Which external device and approved identity should this entry represent? - What protocol and certificate-validation mode are actually configured? - Which public CA references establish the intended trust? - Who may approve an exception to the required identity checks? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends recording the selected validation mode with the external identity, protocol and approved trust references before changing connection settings. - Read the current external-device entry through the supported workflow and identify its real consumer. Compare the stored address and protocol with the approved device inventory. Obtain the relevant public certificate and issuer references through the organization’s established trust process; keep passwords and private keys outside the ordinary review record. - Have the integration and security owners select the intended mode explicitly. If a connection problem motivates the change, investigate the certificate and protocol evidence before using off or limited as a troubleshooting shortcut. Write any separately authorized exception with its purpose and removal owner rather than describing the weaker choice as an equivalent validation result. - Apply only the reviewed connection change in an authorized pilot and read back the relevant settings. Perform a harmless representative connection through the actual consumer. Where permitted, include a controlled untrusted-certificate or identity-mismatch case under its own test plan and compare the observed result with the chosen requirement. Restore the approved arrangement when that result is unresolved. ## Verification and evidence Retain the sanitized entry, validation mode, protocol, public trust references and separate positive and refused-case observations. Ask another reviewer to identify the chosen mode and whether the plan intentionally permits the documented Common Name-disabled branch. Do not let a basic picture replace the trust decision. For a proposed paper case, present a saved entry whose default validation mode was never reviewed. Require an explicit disposition before marking the integration accepted. Keep the actual device’s broader transport and recording checks separate. No certificate validation, connection attempt or compatibility test is reported by this article. ## Official references - [External IP Device Information](https://developer.axis.com/vapix/network-video/external-ip-device-information/) — Axis Communications; official VAPIX documentation. Source review completed October 29, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings. ## Primary reference - Name: Axis Communications — External IP Device Information - Authority: Axis Communications - URL: https://developer.axis.com/vapix/network-video/external-ip-device-information/ - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Choose Axis external-device certificate validation deliberately,” DSE Security, https://update.dsesecurity.com/updates/choose-axis-external-device-certificate-validation-deliberately/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.