Skip to content

feat: add SSL/TLS certificate upload support - #145

Open
mabels wants to merge 1 commit into
starkillerOG:mainfrom
mabels:feature/certificate-upload
Open

feat: add SSL/TLS certificate upload support#145
mabels wants to merge 1 commit into
starkillerOG:mainfrom
mabels:feature/certificate-upload

Conversation

@mabels

@mabels mabels commented Dec 11, 2025

Copy link
Copy Markdown

Summary

This PR adds SSL/TLS certificate management functionality to reolink-aio, enabling automated certificate uploads to Reolink cameras and NVRs.

Changes

Added three new methods to the Host class in reolink_aio/api.py:

  1. clear_certificates() - Clear existing SSL/TLS certificates from the device
  2. import_certificate(cert_content, key_content, cert_name) - Import a new certificate and private key
  3. upload_certificate(cert_content, key_content, cert_name, relogin_delay) - Complete workflow that orchestrates clearing, re-authentication, and import

Implementation Details

  • Follows existing API patterns with async/await
  • Uses proper error handling and logging
  • Automatically re-authenticates after clearing certificates (required by Reolink API)
  • Base64 encodes certificates and keys as required by the API
  • Includes configurable delay for re-login to ensure device is ready

API Commands Used

  • CertificateClear (action: 0) - Removes existing certificates
  • ImportCertificate (action: 0) - Imports new certificate with base64-encoded data

Limitations & Notes

  • Devices only support RSA certificates (not EC variants)
  • Some models (e.g., E1 Pro) may require a reboot to activate the new certificate
  • Requires re-authentication after clearing certificates
  • Based on documented Reolink camera API

Testing

Tested successfully with:

  • Reolink RLC series cameras
  • Integration with cert-manager for automated certificate lifecycle management
  • Production deployment in Kubernetes environment

Use Case

This functionality enables automated certificate management for Reolink devices, particularly useful for:

  • Automated certificate rotation with Let's Encrypt
  • Integration with certificate managers (cert-manager, etc.)
  • Maintaining valid HTTPS certificates on cameras/NVRs

@starkillerOG starkillerOG left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, some small tweaks and then this should be ready to go.

Out of curiosity, did you write this using AI?

Comment thread reolink_aio/api.py Outdated
Comment thread reolink_aio/api.py Outdated
Comment thread reolink_aio/api.py Outdated
Comment thread reolink_aio/api.py Outdated
Comment thread reolink_aio/api.py Outdated
Comment thread reolink_aio/api.py Outdated
@mabels

mabels commented Dec 11, 2025

Copy link
Copy Markdown
Author

Looks good to me, some small tweaks and then this should be ready to go.

Out of curiosity, did you write this using AI?

definitly.

@mabels
mabels force-pushed the feature/certificate-upload branch from 22e98ea to 66a7963 Compare December 12, 2025 07:28
Comment thread reolink_aio/api.py
Comment thread reolink_aio/api.py Outdated
Comment thread reolink_aio/api.py Outdated
  Add certificate management methods to the Host class:
  - clear_certificates(): Clear existing certificates from device
  - update_certificate(): Update certificate and private key (overrides existing)

  This implementation simplifies certificate management for Reolink cameras
  and NVRs. Testing revealed that importing certificates automatically
  overrides existing ones, eliminating the need for a separate clear step
  in most workflows.

  Key improvements over initial implementation:
  - Fixed bug in clear_certificates() to use send_setting() instead of send()
  - Renamed import_certificate() to update_certificate() for clarity
  - Removed upload_certificate() as update_certificate() handles overrides
  - Proper error handling using ReolinkError exceptions
  - Base64 encoding of certificate and key content
@mabels
mabels force-pushed the feature/certificate-upload branch from 446defd to 7f98394 Compare December 13, 2025 19:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants