Panasonic Network Camera BL-VT164 Series BL-VP100 Series Operating Instructions

							•To access the camera via the Internet by connecting the camera to a router, it is necessary to assign
a respective HTTP port number for each camera and address translation by using the port forwarding
function of the router. For further information, refer to the operating instructions of the router in use.Operating Instructions111
15 Configuring the network settings [Network]Router
Internet
(WAN)
Cable modem
XDSL modem Address translation using the port 
forwarding function
vvv.xxx.yyy.zzz:50000 A 192.168.0.1:50000
Address translation using the port 
forwarding function
vvv.xxx.yyy.zzz:50001 A 192.168.0.2:50001 Private address 
192.168.0.1 
Port number: 50000
Private address 
192.168.0.2 
Port number: 50001 LAN
Private address 
192.168.0.254 WAN 
Global address
vvv.xxx.yyy.zzz
Enter [Global IP address + :
(colon) + port number] in the
Address box of the browser 
 via the Internet.
vvv.xxx.yyy.zzz:50000
vvv.xxx.yyy.zzz:50001  
						

							15.2  Configure the HTTPS settingsClick the [Network] tab on the “Network” page. ( ®page 34, page 35)
The settings relating to the HTTPS protocol that can enhance the network security by encrypting the access
to cameras on this page.
The HTTPS settings will be configured in the following procedure.
Generation of the CRT key (SSL encryption key) ( ®page 113)
Generation of the self-signed certificate ( ®page 114)
Generation of CSR (Certificate Signing Request) ( ®page 116)
Installation of the server certificate ( ®page 117)
Configuration of the connection protocol ( ®page 118)
112Operating Instructions
15 Configuring the network settings [Network]Generation of the CRT key (SSL encryption key)
Con figuration of the connection protocol
Access to the cameras using the HTTPS protocol
Application for the approval by CA 
(Certi ficate Authority) - Issue of the server certifi cate
Generation of CSR (Certi ficate Signing Request)
Installation of the server certi ficate
Generation of the self-signed certi ficateWhen using the server certi ficate When using the self-signed certifi cate A
B
C
D
E       
						

							Note•To use the server certificate, you need to apply for the approval and the issue of server certificate by
CA.
• Either of the self -signed certificate or the server certificate is available. If both of them are installed, the
server certificate will be used prior to the self-signed certificate.
15.2.1  Generation of the CRT key (SSL encryption key)
IMPORTANT •When the self- signed certificate or server certificate is valid, it is impossible to generate the CRT key.
• When the server certification is used, the available key size varies depending on the Caches the
available key size in advance.
• To generate the CRT key, it may take about 1 minute when the key size is 1024 bit and about 2 minutes
when the key size is 2048 bit. Do not operate the web browser until the generation of CRT key is
complete. While the CRT key is being generated, the refresh interval and line speed may be lower.
1. Click the [Execute] button of “CRT key generate”.
→ The “CRT key generate” dialog box will be displayed.
2.Select “1024bit” or “2048bit” for the length of the CRT to generate for “CRT key generate” - “RSA key
size”.
Note
•To use the server certificate, follow the requests from the CA about the RSA key size.
3. Click the [Execute] button.
→ The generation of CRT key will be started. When the generation is finished, the key size and generation
time & date of the generated key will be displayed on “Current CRT key”.
Note
•To change (or update) the generated CRT key, perform step 1 to 3. The CRT key, self -signed certificate
and server certification are valid in a set. When the CRT key is changed, it is necessary to re -generate
the self-signed certificate or re-apply for the server certificate.
• When the CRT key is updated, the log of the previous CRT key is saved. When the [ History] button of
“ Current CRT key ” on the  “CRT key generate ” dialog box is clicked, the  “Previous CRT key ” dialog box
will be displayed, and it is possible to check the key size and generation time & date of the previous
Operating Instructions113
15 Configuring the network settings [Network]  
						

							key. When the [Apply] button is clicked on the  “Previous CRT key” dialog box, it is possible to replace
the current CRT key with the previous one.
15.2.2  Generation of the self-signed certificate (security
certificate)
IMPORTANT •If the CRT key is not generated, it is impossible to generate the self-signed certificate.
1. Click the [Execute] button of “Self-signed Certificate - Generate”.
→ The “Self-signed Certificate - Generate” dialog box will be displayed.
2.Enter the information of the certificate to be generated.
ItemDescriptionAvailable number of characters[Common Name]Enter the camera address or host name.64 characters[Country]Enter the country name. (Omission is OK.)2 characters (Country code)[State]Enter the state name. (Omission is OK.)128 characters[Locality]Enter the locality name. (Omission is OK.)128 characters[Organization]Enter the organization name. (Omission is OK.)64 characters114Operating Instructions
15 Configuring the network settings [Network]   
						

							ItemDescriptionAvailable number of characters[Organizational
Unit]Enter the unit name of the organization.
(Omission is OK.)64 characters[CRT key]Displays the key size and generation time  & date
of the current key.
Note
•The available characters for [Common Name], [State], [Locality], [Organization], [Organizational
Unit] are 0-9, A-Z, a-z and the following marks.
- . _ , + / ( )
• When the camera is connected to the Internet, enter the address name or host name to access via
the Internet for  “Common Name ”. In this case, the security alert window will be displayed each time
the camera is locally accessed, even if the security certificate is installed.
• When entering the IPv6 address for “Common Name”, put the address in brackets [ ].
Example:  [2001:db8::10]
3. Click the [OK] button after entering the items.
→ The self-signed certificate will be generated.
Note
•The information of the generated self-signed certificate will be displayed on “Self-signed
Certificate” - “Information”.
Depending on the status of the self-signed certificate, the following are displayed.
IndicationDescriptionNot generatedThe self-signed certificate are not generated.Invalid (Reason: CA Certificate installed)The self-signed certificate has already been
generated, and the server certificate has been
installed.
• In this case, the server certificate is validated.Common name of the self-signed
certificateThe self-signed certificate has already been
generated and validated.
• When the [Confirm] button is clicked, the registered information of the self-signed certificate
(security certificate) will be displayed in the “Self-signed Certificate - Confirm” dialog box.
Operating Instructions115
15 Configuring the network settings [Network]  
						

							•When the [Delete] button is clicked, the generated self-signed certificate (security certificate) will
be deleted.
• When “HTTPS” is selected for “Connection”, it is impossible to delete the self-signed certificate.
15.2.3  Generation of CSR (Certificate Signing Request)
IMPORTANT •If the CRT key is not generated, it is impossible to generate the CSR.
• Before generating the CSR file, configure the following settings on [Internet Options] of the web browser
in advance. Click [ Internet Options...] under [ Tools] of the menu bar of Internet Explorer, and then click
the [Security] tab.
– Register the camera for [Trusted Sites].
– Click the [Custom Level...] button to open the [Security Setting] window, and check the [Enable]
radio button of [File Download] under [Downloads].
– Click the [Custom Level...] button to open the [Security Setting] window, and check the [Enable]
radio button of [Automatic prompting for file downloads] under [Downloads].
1. Click the [Execute] button of “CA Certificate - Generate Certificate Signing Request”.
→ The “CA Certificate - Generate Certificate Signing Request” dialog box will be displayed.
2.Enter the information of the certificate to be generated.
ItemDescriptionAvailable number of characters[Common Name]Enter the camera address or host name.64 characters[Country]Enter the country name.2 characters (Country code)[State]Enter the state name.128 characters[Locality]Enter the locality name.128 characters[Organization]Enter the organization name.64 characters[Organizational
Unit]Enter the unit name of the organization.64 characters116Operating Instructions
15 Configuring the network settings [Network]  
						

							ItemDescriptionAvailable number of characters[CRT key]Displays the key size and generation time & date
of the current key.
Note
•To use the server certificate, follow the requests from the CA about the information to be entered.
• The available characters for [Common Name], [State], [Locality], [Organization], [Organizational
Unit] are 0-9, A-Z, a-z and the following marks.
- . _ , + / ( )
3. Click the [OK] button after entering the items.
→ The [Save As] dialog box will be displayed.
4. Enter a file name for the CSR in the [Save As] dialog box to save on the PC.
→ The saved CSR file will be applied to the CA.
IMPORTANT
•The server certificate will be issued for the set of the generated CSR and CRT key. If the CRT key is
re-generated or updated after applying to the CA, the issued server certificate will be invalidated.
Note
•This camera generates the CSR file in the PEM format.
15.2.4  Installation of the server certificate
IMPORTANT •If the CSR file is not generated, it is impossible to install the server certificate (security certificate). For
the installation, the server certificate issued by CA is required.
• A server certification issued by CA is needed in order to install the server certification.
1. Click the [Browse...] button of “CA Certificate - CA Certificate install”.
→ The [Open] dialog box will be displayed.
2. Select the server certification file and click the [Open] button. Then, click the [Execute] button.
→ The server certification will be installed.
Note
•The host name registered in the installed server certificate will be displayed on “CA Certificate -
Information”. Depending on the status of the server certificate, the following are displayed.
IndicationDescriptionInvalidThe server certification is not installed.Common name of the server certificateThe server certificate has already been installed
and validated.ExpiredThe server certification has already expired.Operating Instructions117
15 Configuring the network settings [Network] 
						

							•When the [Confirm] button is clicked, the registered information of the installed server certificate
will be displayed in the “CA Certificate - Confirm” dialog box. (Only “Organizational Unit” will be
displayed with an asterisk (*).)
• When the [Delete] button is clicked, the installed server certificate will be deleted.
• When “HTTPS” is selected for “Connection”, it is impossible to delete the server certificate.
• To change (or update) the server certificate, perform step 1 and 2.
IMPORTANT
•Before deleting the valid server certificate (security certificate), confirm that there is a backup file on
the PC or another media. The backup file will be required when installing the server certificate again.
• When the server certificate has expired, the HTTPS function will become unavailable. When the
camera is restarted, the connection protocol will be changed to HTTP. Update the server certificate
before it expires.
• The expiration date of the server certificate can be checked by double-clicking the server certification
file issued by CA.
15.2.5  Configuration of the connection protocol 1.Select “HTTP” or “HTTPS” for “Connection” to determine the protocol used to access the camera.
• HTTP:  Only the HTTP connection is available.
• HTTPS:  Only the HTTPS connection is available.
2. Designate the HTTPS port number to be used for “HTTPS port”.
• Available port number:  1 - 65535
• Default:  443
The following port numbers are unavailable since they are already in use.
20, 21, 23, 25, 42, 53, 67, 68, 69, 80, 110, 123, 161, 162, 554, 995, 10669, 10670, 59000 - 61000
3. Click the [Set] button.
→ The camera will restart, and it will become possible to access to the cameras using the HTTPS protocol.
( ® page 7, page 19, page 22)
Note
•The camera will restart after the connection setting is changed.
• When using the self-signed certificate:
If the camera is accessed using the HTTPS protocol for the first time, the warning window will be
displayed. In this case, follow the instructions of the wizard to install the self-signed certificate.
( ® page 119)
• When using the server certificate:
118Operating Instructions
15 Configuring the network settings [Network]  
						

							In advance, install the root certificate and intermediate certificate on the browser in use. Follow the
instructions of CA for how to obtain and install these certificates.
• When the camera is accessed using the HTTPS protocol, the refresh interval and frame rate of images
may be lower.
• When the camera is accessed using the HTTPS protocol, it may take time to display images.
• When the camera is accessed using the HTTPS protocol, the images may be distorted or audio may
be interrupted.
• When the camera is accessed using the HTTPS protocol, the number of users that can access the
camera may be reduced. The maximum number of concurrent access user varies depending on the
maximum image size and transmission format.
15.3  Access the camera using the HTTPS protocol 1.Start up the web browser.
2. Enter the IP address of the camera in the address box of the browser.
• Example of entry:  https://192.168.0.10/
IMPORTANT
•When the HTTPS port number is changed from “443”, enter “https://IP address of the camera + :
(colon) + port number” in the address box of the browser.
( Example:  https://192.168.0.11:61443)
• When the camera is in a local network, configure the proxy server setting of the web browser (under
[ Internet Options...] under [ Tools] of the menu bar) to bypass the proxy server for the local address.
3. Press the [Enter] key on the keyboard.
→ The “Live” page will be displayed.
When the security alert window is displayed, install the security certificate. ( ®page 120 - page 126)
When “On” is selected for “User auth.”, the authentication window will be displayed before displaying
live images for the user name and password entries.
IMPORTANT
•When the camera is accessed using the HTTPS protocol, the refresh interval and frame rate of
images may be lower.
15.3.1  Install the security certificate When the security certificate of the camera to access is not installed on the PC, the security alert window will
be displayed each time the camera is accessed using the HTTPS protocol. To have the security alert window
not displayed, it is necessary to install the security certificate in the following procedure. If the certificate is not
installed, the alert window will be displayed each time the camera is accessed.
Note
•The security certificate is installed on the PC with the information registered for “Common Name”.
Therefore, the information registered for  “Common Name ” must be same as the address or host name
for the camera access. If the certificate is not the same, the security alert window will be displayed
each time the camera is accessed.
• When the address or host name of the camera is changed, the security alert window will be displayed
each time the camera is accessed even if the security certificate is installed. Install the security
certificate again.
Operating Instructions119
15 Configuring the network settings [Network] 
						

							•When the camera access is open to the Internet, enter the address name or host name to access via
the Internet for “Common Name”. In this case, the security alert window will be displayed each time
the camera is locally accessed, even if the security certificate is installed.
• When the security certificate is properly installed, a key icon is displayed in the address box of the web
browser that has accessed the camera. (When using Internet Explorer 7, Internet Explorer 8, or Internet
Explorer 9)
When using Internet Explorer 7, Internet Explorer 8, or Internet Explorer 9 When using Internet Explorer 7 or Internet Explorer 8 with Windows XP, note that some of the displayed
windows may differ from the following descriptions.
1. Access the camera using the HTTPS protocol.
2. When the security alert window is displayed, click “Continue to this website (not recommended).”
→Enter the user name and password. The “Live” page will be displayed.
Note
•If this window is displayed when accessing a device other than the camera or a website, a security
problem may have occurred. In this case, check the system status.
120Operating Instructions
15 Configuring the network settings [Network]