The camera has 3 places where an identity can be set.
SAN field in the certificate.
CN field in the certificate.
Identity field at the 802.1x config > typically not used
If one is not present or invalid, it will automatically go for the next name/ identity as fallback when denied by the server after one or two failed attempts.
The order in how it get used is different between the platforms.
RTOS (CPP4, 6, 7, 7.3) and Linux(cpp14) -> (1) SAN – (2) CN - (3) Config Inteox (CPP13) -> (1) Config - (2) SAN - (3) CN
In order to add the Subject Alternative Name, you can use "Bosch Configuration Manager" or the camera's web page using latest Firmware
LINUX - FW 9.40 or newer
Android - FW 8.93 or newer
RTOS - FW 8.90 or newer
Step-by-step guide
Open Configuration Manager and select the camera for which the Subject Alternative Name of its certificate should be added
Authenticate on the camera and go to Service > Certificates
Select one of the 2 options below where the Subject Alternative Name can be added:
SAN (subject alternative name):
When using a DNS name in the SAN (subject alternative name) it is important to keep this identical to the identity known by the Domain server (Identity = CN). When authentication takes place and a DNS name is detected, this will be used as identity and the CN will be ignored. Note: According to RFC5216 the EAP-TLS Identity must be identical to the 'subjectAltName' field in the certfictate, if present.
Nice to know:
Bosch IP cameras: authentication failed in RADIUS server due to unsupported certificate
... View more