Track certificate expiry for KiwiVision confidential recordings

Include encryption-certificate validity in the recording continuity checks for KiwiVision confidential streams.

Source facts

Genetec’s KiwiVision guide for Security Center 5.13.1.0 states that expired certificates are no longer used for encryption. If no valid certificates remain, recording stops. The Archiver uses public certificate material to encrypt the original stream; viewing that stream requires the relevant private key on a smart card. Auxiliary Archivers record the transformed privacy-protected stream rather than the confidential original.

Source: Genetec — About confidential video stream encryption, Security Center 5.13.1.0.

Applicability

Apply this to the documented KiwiVision confidential-stream encryption design. Check the installed release and configuration before extending these behaviors to another Genetec deployment.

DSE recommendation

DSE recommends a certificate register linking each affected camera and Archiver to its encryption certificates, expiry dates, renewal owner, and approved private-key custody arrangements. Schedule renewal before the last usable certificate expires. Review the original and privacy-protected recording paths separately, because a blurred recording alone should not close a confidential-recording check. Keep renewal evidence and an escalation contact with the maintenance record. Arrange a supported recovery plan before changing certificate material.

Verification

After an approved renewal, verify new recording and authorized playback of the original stream, then verify the privacy-protected path. Record which certificate was exercised. Do not deliberately expire production certificates as a test or export private keys into routine reports.

Official reference

Genetec — About confidential video stream encryption, Security Center 5.13.1.0. Reviewed October 14, 2026.