How to add the ‘Subject Alternative Name’ to the Bosch IP cameras certificate?

[#1]

The camera has 3 places where an identity can be set.

• SAN field in the certificate.
• CN field in the certificate.
• Identity field at the 802.1x config > typically not used

If one is not present or invalid, it will automatically go for the next name/ identity as fallback when denied by the server after one or two failed attempts.

The order in how it get used is different between the platforms.

RTOS (CPP4, 6, 7, 7.3) and Linux(cpp14) -> (1) SAN – (2) CN - (3) Config
Inteox (CPP13) -> (1) Config - (2) SAN - (3) CN

In order to add the Subject Alternative Name, you can use "Bosch Configuration Manager" or the camera's web page using latest Firmware

• LINUX - FW 9.40 or newer
• Android - FW 8.93 or newer
• RTOS - FW 8.90 or newer

Step-by-step guide

1. Open Configuration Manager and select the camera for which the Subject Alternative Name of its certificate should be added
2. Authenticate on the camera and go to Service > Certificates
3. Select one of the 2 options below where the Subject Alternative Name can be added:

 SAN (subject alternative name):

When using a DNS name in the SAN (subject alternative name) it is important to keep this identical to the identity known by the Domain server (Identity = CN).
When authentication takes place and a DNS name is detected, this will be used as identity and the CN will be ignored.
Note: According to RFC5216 the EAP-TLS Identity must be identical to the 'subjectAltName' field in the certfictate, if present.

 Nice to know:

• Bosch IP cameras: authentication failed in RADIUS server due to unsupported certificate