Configure network security
Applies to: Pearl-2, Pearl Mini, Pearl Nexus, Pearl Nano
Pearl devices support 802.1x network security. You can choose the authentication method, upload user certificates and private key, as well as manage signed CA certificates using the Admin panel. You can also configure your Pearl device to use HTTPS.
For higher security, we recommend setting admin, operator, and viewer-level passwords on the device.
Configure 802.1x network security and manage user certificates
You can enable 802.1x security and configure the EAP method for the device to use for secure network access using the Admin panel. Supported EAP methods include:
- PEAP (default)
- EAP-TLS
- EAP-TTLS
Important considerations
If TLS authentication is used on the network, then you need to get a user certificate and a user private key from the network administrator and upload those to your device as part of this procedure.
Before you proceed with this setup, check that the network server's signed CA certificate appears in the list of CA certificates on the device and is valid.
If the network server's CA certificate doesn't appear in the list of signed CA certificates and you can't obtain a valid signed CA certificate for network server authentication, do not check Verify server's identity when performing this setup.
Security certificates must be PEM encoded.
Configure 802.1x and upload the user certificate and user private key using the Admin panel
Log in to the Admin panel as admin.
From the Configuration menu, select Network. The Network configuration page opens.
Under IEEE 802.1x, check Enabled and select an EAP method: PEAP, EAP-TLS, or EAP-TTLS.
(Optional) Check Verify server's identity.
Choose an Authentication method if you selected EAP-TTLS as the EAP method. The authentication method is automatically selected if PEAP or EAP-TLS is the EAP method.
Table — Authentication methods
| EAP method | Authentication method |
|---|---|
| PEAP | EAP-MSCHAPv2 |
| EAP-TLS | TLS |
| EAP-TTLS | EAP-MSCHAPv2 |
| TLS | |
| PAP |
Enter the network access User name and Password to use for this device. Available fields depend on the EAP method that is selected.
If TLS is chosen as the Authentication method, upload a user certificate and a user private key. You can request those from your network administrator.
Click Apply when you're done.
Reboot the device when prompted. After the system has finished rebooting, log back in to the Admin panel as admin and verify that all changes were applied.
If you need to delete the user certificate or private key, click Delete certificate.
Manage CA and self-signed certificates
You can view the list of CA and self-signed certificates that come preloaded on the device. CA and self-signed certificates are used for server authentication if Verify server's identity is selected when 802.1x network security is configured.
The self-signed certificate from Epiphan Video is selected by default. You can add more CA signed and self-signed certificates using the Admin panel, as well as delete any certificates that you've uploaded. You cannot delete any of the built-in CA certificates that came preloaded on the device. Security certificates must be PEM encoded.
When using the Epiphan Video self-signed certificate:
Your web browser may warn of an untrusted certificate when you try to access the web-based Admin panel. You can dismiss the warning and continue to the Admin panel.
Certain low and medium-level results are expected when scanning the network for vulnerabilities while the device is connected and an active Admin panel session is in progress. Contact Epiphan Video Support for more information.
Manage CA and self-signed certificates using the Admin panel
Log in to the Admin panel as admin.
From the Configuration menu, select Security. The Security configuration page opens.
Under CA certificates, click the arrow head to expand the list of built-in CA and self-signed certificates that came preloaded on the device.
To upload a new CA or self-signed certificate, click Choose File and select the certificate you want to upload. Then click Apply. The uploaded certificate is added to a list of user uploaded CA certificates.
To delete a CA or self-signed certificate that you've uploaded, click Choose File and select the certificate you want to delete from the list. Then click Delete. When you're done, click Apply.
Reboot the device when prompted. After the system has finished rebooting, log back in to the Admin panel as admin and verify that all changes were applied.
Configure HTTPS
You can configure the device to use HTTPS for secure, local network access to the Admin panel, as well as for viewing the live channel preview stream on the local network using the Live broadcast URL.
The default HTTP port 80 redirects traffic to the default HTTPS port 443 when HTTPS is enabled. If the default ports used by the device are not available on your network, you can change them using the Admin panel.
Custom applications that use the device's HTTP API should continue to work if you configure the device for HTTPS.
A default, self-signed certificate from Epiphan Video comes preloaded on the device. You can upload and delete your own certificate and private key. However, you cannot delete the default self-signed certificate that comes preloaded on the device.
If you upload your own self-signed certificate and private key, ensure they're PEM encoded. Certificates can either include the private key or be separate files.
If you attempt to access the web-based Admin panel using a web browser and the required security certificate isn't found in the list of certificates loaded on the device, a warning message appears stating that the device isn't trusted. You can choose whether to proceed and connect to the device's web-based Admin panel without the security certificate authentication or cancel the connection.
If the Epiphan Video self-signed certificate is selected, your web browser may warn of an untrusted certificate when you try to access Pearl's web-based Admin panel. You can dismiss the warning and continue to the Admin panel for your device.
Configure HTTPS and upload a self-signed certificate using the Admin panel
Log in to the Admin panel as admin.
From the Configuration menu, select Security. The Security configuration page opens.
Under HTTPS configuration, check Secure connection (HTTPS).
(Optional) Change the default HTTP and the HTTPS port numbers. Consult your network administrator.
(Optional) Upload a new certificate and private key as required. You can request those from your network administrator.
If the required certificate isn't included in the list of certificates on the device when you try and connect to the device using a web-browser, you'll receive a warning that the device isn't trusted.
Click Apply when you're done.
Reboot your device when prompted. After the system has finished rebooting, log back in to the Admin panel as admin and verify that all changes were applied.
If you need to delete the certificate you uploaded and the private key, click Delete certificate, or click Restore default certificate.
Configure HTTP Keep Alive Settings
You can customize the HTTP Keep Alive settings that the device will use with third-party connections. The values you can modify are the HTTP Keep-Alive Timeout and the HTTP Maximum Keep-Alive Requests.
HTTP Keep-Alive timeout: Maximum amount of time the device will keep a TCP connection to a third-party HTTP control system open.
HTTP Maximum Keep-Alive requests: The maximum number of HTTP Keep-Alive requests the device will accept within the specified Keep-Alive timeout.
Configure HTTP Keep-Alive Timeout and HTTP Maximum Keep-Alive requests
Log in to the Admin panel as admin.
From the Configuration menu, select Security. The Security configuration page opens.
Under HTTPS configuration, find the HTTP Keep-Alive Timeout and HTTP Maximum Keep-Alive Requests.
Modify these values as needed.
Click Apply when you're done.
Your device will reboot. After the system has finished rebooting, log back in to the Admin panel as admin and verify that all changes were applied.