Axis Communications Deployment Hook

[kiler129]

Hi,

What I want to do

I recently was tasked with deploying certificates to Axis cameras. Normally, when managed by its vendor-provided software, this process is already automated. The software seems to setup its own private CA and auto-deploy & renew certificates on cameras, while also trusting them on the management computer.

Why & how

I want to cut them off the free (but proprietary & windows-only) AXIS Device Manager. Cameras have a pretty robust and well-documented REST API called "VAPIX". I found the following example under "Upload a certificate with private key", replicated below in case the link changes:

POST /config/rest/cert/v1/certificates HTTP/1.1
HOST: my-device
Content-Type: application/json

{
    "data": {
        "alias": "My Certificate",
        "certificate": "-----BEGIN CERTIFICATE-----\npem-encoded-data\n-----END CERTIFICATE-----",
        "keystore": "SE0",
        "private_key": "-----BEGIN PRIVATE KEY-----\npem-encoded-data\n-----BEGIN PRIVATE KEY-----"
    }
}

I need some guidance

Since different versions of the software support different parameters, I need to ensure some error-fallback. For example, older versions don't support ECC certs while newer ones will refuse ones with small RSA key.

Looking through the repo I found a Ruckus deployment hook that seems to solve the same set of problems:

1. Would that be a good base for adding support for Axis cameras?
2. Should I force the alias parametr to a common name?
3. Is uploading cert+key every time a recommended method, or should I handle the scenario of renewal without key change? The vendor API seems to have a PATCH support where only certificate is renewed but key doesn't change.
4. I didn't test it yet, but I may need to upload the CA chain separately - are there any examples of that in acme.sh already?