From 6890d1889c35be909d54e983f508afd37d53cacb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Verstraeten?= Date: Tue, 18 Aug 2026 11:03:15 +0200 Subject: [PATCH] Document AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILE Update the README and RTSPS/TLS guide to describe the dedicated RTSPS CA bundle variable instead of relying on SSL_CERT_FILE. The bundle is appended to the system roots for camera RTSPS connections only, and the validation examples and env-var table are updated accordingly. --- README-RTSPS-TLS.md | 9 ++++++--- README.md | 3 ++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/README-RTSPS-TLS.md b/README-RTSPS-TLS.md index 242eb74..359d3fc 100644 --- a/README-RTSPS-TLS.md +++ b/README-RTSPS-TLS.md @@ -75,7 +75,7 @@ sequenceDiagram participant Trust as Go trust pool participant Camera as Camera RTSPS :9554 - Agent->>Trust: Load trusted CAs from SSL_CERT_FILE and CA directories + Agent->>Trust: Load system roots and append AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILE Agent->>Camera: Open TCP connection Agent->>Camera: Send TLS ClientHello Camera-->>Agent: Send TLS ServerHello and camera certificate @@ -505,7 +505,8 @@ openssl s_client \ On Unix, Go uses `SSL_CERT_FILE` instead of its default aggregate CA file, but it still scans default certificate directories such as `/etc/ssl/certs`. Setting `SSL_CERT_FILE` alone therefore does not remove CA certificates installed with -`update-ca-certificates`. +`update-ca-certificates`. `AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILE` is appended +after this system pool is loaded; it does not replace the system roots. Blank values do not select empty trust sources. Both `SSL_CERT_FILE=` and `SSL_CERT_DIR=` are treated as unset, so Go falls back to its default aggregate @@ -517,6 +518,7 @@ directory path that contains no certificates: mkdir -p /tmp/empty-ca-dir SSL_CERT_FILE=/dev/null \ SSL_CERT_DIR=/tmp/empty-ca-dir \ +AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILE= \ AGENT_CAPTURE_IPCAMERA_RTSPS_INSECURE=false \ GOWORK=off \ go run -tags moq . -action run -port 8080 @@ -553,8 +555,9 @@ openssl req \ -keyout /tmp/unrelated-test-root.key \ -out /tmp/unrelated-test-root.crt -SSL_CERT_FILE=/tmp/unrelated-test-root.crt \ +SSL_CERT_FILE=/dev/null \ SSL_CERT_DIR=/tmp/empty-ca-dir \ +AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILE=/tmp/unrelated-test-root.crt \ AGENT_CAPTURE_IPCAMERA_RTSPS_INSECURE=false \ GOWORK=off \ go run -tags moq . -action run -port 8080 diff --git a/README.md b/README.md index b63c2b1..4703592 100644 --- a/README.md +++ b/README.md @@ -200,7 +200,7 @@ AGENT_CAPTURE_IPCAMERA_SUB_RTSP='rtsps://username:password@camera.example:9554/? Certificate verification is enabled by default. The URL hostname or IP address must match the camera certificate SAN. On this Bosch firmware, RTSPS presents the certificate assigned to **HTTPS**; there is no separate SRTSP certificate usage. Leave **CBS client** assigned to the Bosch device certificate. -For a private CA, mount a PEM trust bundle containing every CA certificate needed to build the camera certificate chain and set `SSL_CERT_FILE` to that file. This Bosch firmware presents only its leaf certificate, so include both the issuing intermediate and root certificates in the bundle. As a temporary fallback, `AGENT_CAPTURE_IPCAMERA_RTSPS_INSECURE=true` disables certificate verification for camera streams only. +For a private CA, mount a PEM trust bundle containing every CA certificate needed to build the camera certificate chain and set `AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILE` to its path inside the Agent. The bundle is appended to the system roots for camera RTSPS connections only. This Bosch firmware presents only its leaf certificate, so include both the issuing intermediate and root certificates in the bundle. As a temporary fallback, `AGENT_CAPTURE_IPCAMERA_RTSPS_INSECURE=true` disables certificate verification for camera streams only. See [RTSPS and TLS certificates](README-RTSPS-TLS.md) for the complete Bosch UI, private-CA, deployment, validation, and troubleshooting procedure. @@ -225,6 +225,7 @@ See [RTSPS and TLS certificates](README-RTSPS-TLS.md) for the complete Bosch UI, | `AGENT_REGION_POLYGON` | A single polygon set for motion detection: "x1,y1;x2,y2;x3,y3;... | "" | | `AGENT_CAPTURE_IPCAMERA_RTSP` | Full-HD RTSP or RTSPS endpoint for the target camera. | "" | | `AGENT_CAPTURE_IPCAMERA_SUB_RTSP` | RTSP or RTSPS sub-stream endpoint used for livestreaming (WebRTC). | "" | +| `AGENT_CAPTURE_IPCAMERA_RTSPS_CA_FILE` | PEM CA bundle appended to the system roots for RTSPS camera certificate verification. | "" | | `AGENT_CAPTURE_IPCAMERA_RTSPS_INSECURE` | Disable RTSPS camera certificate verification; use only when a trusted CA cannot be installed. | "false" | | `AGENT_CAPTURE_IPCAMERA_BASE_WIDTH` | Force a specific width resolution for live view processing. | "" | | `AGENT_CAPTURE_IPCAMERA_BASE_HEIGHT` | Force a specific height resolution for live view processing. | "" |