How do I setup motion webcontrol GUI with OpenWRT ssl certificates?

Installing and Using OpenWrt
1

Hello. I have discovered that motion package I use for my IP cameras can establish connection via https. Here is link to manual Motion

webcontrol_tls
Type: Boolean
Range / Valid values: on, off
Default: off
This option specifies whether to enable SSL/TLS for the webcontrol port. For some distributions the library that Motion uses may not have been compiled with SSL/TLS support. In this situation Motion can not support SSL/TLS connections. Whether SSL/TLS can be supported will be reported in the log. In addition to selecting this option, a webcontrol_cert and webcontrol_key file must also be specified.

webcontrol_cert
Type: String
Range / Valid values: Max 4095 characters
Default: Not defined
Full path to the certification file for SSL/TLS support. Only used when webcontrol_tls is enabled.

webcontrol_key
Type: String
Range / Valid values: Max 4095 characters
Default: Not defined
Full path to the key file for SSL/TLS support. Only used when webcontrol_tls is enabled.

But it reqires two files, which are webcontrol_cert and webcontrol_key

I managed to discover /etc/ssl directory with:

/certs
/private
@cert.pem

/private is empty but there is /etc/ssl/certs/ca-certificate.ca file in /certs

I just not very concern how do I specify these files in motion config, and are this files sufficient?

I can specify webcontrol_cert /etc/ssl/certs/ca-certificate.cabut I doubdt that it is the right thing to do and I can not understand what I need to specify in webcontrol_key May be I need to generate some additional certificates?

Any help would be appreciated. Many thanks!

2

It needs to be a pair of private and public key, like /etc/uhttpd.zzz files by default.

1 Like
3

I can generate this files or must obtain it from somewhere?

4
  • Do you run your own Certificate Authority server?

(Or use the ones generated by the OpenWrt.)

  • Do you desire your certs to be valid globally?
5

Cheapest option is to re-use uhttp self-signed cert+key, then all browsers have it already approved.

2 Likes
6

No, nothing really that big. I just want browser not to complain about “Unsafe connection”.

7

Set cert and key to uhttpd files in /etc/ ?

It will complain every other browser upgrade just like https//openwrt,lan

2 Likes
8

You can always get a wildcard cert via ACME, but you'll probably need a public IP for the initial setup.

1 Like