I was able to configure Netcam Studio for https using a free certificate from Lets Enrypt. I have my own domain registered with no-ip.com (www.ngcard.net) and I set up a sub domain for use by Netcam Studio (ww2.ngcard.net) this uses dynamic DNS through no-ip.com. Up until now this subdomain was running on plain old http, so I was starting to see the mixed content issues with my main site.
To create a Lets Enrypt certificate I followed these instructions to install certbot on my Netcam Studio Server. I also had to make sure I port forwarded port 80 to the server because certbot uses this to prove that you own the server and also will automatically renew the certificate every 3 months. It’s safe to leave port 80 open since it will only be live while certbot is doing it’s thing. I run Netcam Studio on port 8100. Also if you run the Windows Defender Firewall, make sure you allow port 80 traffic for certbot - the certbot installer doesn’t do this for you. Certbot Instructions | Certbot
I ran the command certbot certonly --standalone
Running certbot will prompt you for some information including the domain you would like to create a certificate for - I entered ww2.ngcard.net. It will then generate a certificate for you and place it in C:\Certbot\live[certificate_name]. It actually creates several variations. You want to use the one named fullchain.pem.
Once you have your fullchain.pfx file follow the netcam studio directions for importing the certificate into the Windows certificate store and copying to the Netcam Studio folder, and configuring the Netcam Studio configuration files.
Regarding the automatic renewal. There are some other problems to solve. Here’s what I did.
Each time the cert renews, you do need to convert it to a pfx, copy the pfx file to the Netcam Studio folder and also install the cert into the local store. To automate that I did this…
Download and install OpenSSL 64 bit for windows. You’ll end up with a folder that contains openssl.exe.
In this folder create convert.bat and save this in it. Modify the openssl path to wherever you installed it.
In the same folder create convert.ps1 and save this in it. Again, modify the paths as needed. I’m also assuming you are running Netcamstudio as a service.
Modify the “Certbot Renew Task” scheduled task to run as SYSTEM for it to work properly. Also modify the Action to add a posthook parameter to run the above scripts at renewal.
Import-PfxCertificate : The PFX file you are trying to import requires either a different password or membership in an Active Directory principal to which it is protected.
I have added a password that I don't know where I got at the end of the 2nd line to -passout pass:password
If it is the wrong password, which is where I put my money, how/where do I get the password?
Kent
writes about adding these lines to the config files. I assume that server.pfx is the name of the pfx certificate file. I can do that, But were does “WebServerCertificatePass” value “test” come from? Do I set it somewhere? Where and how is that set?
You have two files in pem-format: fullchain.pem and privkey.pem
Windows use the pfx format so you must convert pem to pfx.
The pfx format consists of a certificate file xxxx.pfx and a password. In the conversion process from pem to pfx you must manually add a password. Remember that password since it is used in the NCS configuration file.
For the conversion you can either use openssl as ngcard shows above or an online converter website. I don´t know why you get the error with the openssl so I recommend to do this first so you know your pem certificate works. I used this online free service SSL Converter - Convert SSL Certificates to different formats
Add files and password as
When configurations are done start NCS X server, blue icon. At the bottom it should now state https://computerIP:8100
When you start the clients make sure to enable https.
When this works all is fine with the certificate. If you want to automate like ngcard go back to the openssl and add a password to -passout pass:xxxxx
