PKI

Run a small internal certificate authority for your XProtect™ site without leaving the Management Client. Issue Root and Intermediate CAs, generate HTTPS / 802.1X / Service certificates, import existing ones (PEM, DER, PKCS#12), and deploy them onto each XProtect server with the bundled PKI Cert Installer.

Every certificate (and private key, where present) is stored as a MIP item on the Management Server, so the entire vault travels with your XProtect configuration backups.

Restrict who can read these items

Each certificate item stores its PKCS#12 bundle (cert + private key) on the Management Server. A user that can read a PKI item can extract the private key. Grant Read only to admin-level operators, and use the per-kind Read permission to keep Root CA private keys away from anyone who only needs to deploy leaf certs. See Role permissions below.

Quick Start

1. Open Site Navigation > MIP Plug-ins > PKI > Overview in the Management Client
2. Click Auto setup. The plugin generates a Root CA (MSCP PKI (yyyy.MM) - Root CA, valid 15 years) and issues one Service certificate per discovered XProtect service, with hostname / FQDN / IPs already in the SAN list
3. On each XProtect server, run PKI Cert Installer (see Deploying certs below), sign in, pick the matching cert, click Install, then open the Server Configurator to apply

Tree layout

Node	Purpose
Overview	Master grid of every cert. Filter by folder / issuer, search, bulk export, bulk delete, run Auto setup.
CA Certificates > Root Certificates	Self-signed Root CAs. Sign Intermediates and leaf certs.
CA Certificates > Intermediate Certificates	CAs signed by a Root. Recommended issuer for day-to-day leaf certs.
Client Certificates > HTTPS Certificates	Server TLS certs (Recording Server / Mobile / Event Server / Mgmt Server).
Client Certificates > 802.1X Certificates	Client certs for IEEE 802.1X port authentication on cameras / NVRs.
Client Certificates > Service Certificates	Generic service-to-service TLS certs.

Deploying certs

The Management Client side only stores certificates. It does not push them into the Windows certificate store on each XProtect server. Two ways to deploy:

PKI Cert Installer (recommended)

A standalone single-file EXE that talks to the same Management Server REST endpoint as the plugin. No MIP SDK runtime required.

1. Download Mscp.PkiCertInstaller-vX.X.exe from your local download page at http://<management-server>/mscp/ (see Local Download Page)
2. Run it on the target XProtect server as Administrator
3. Sign in to the Management Server with a user that has the required PKI read permissions
4. Pick the row where Machine Match shows Yes, click Install
5. For an XProtect service cert: click Open Server Configurator and apply the new cert
6. For a workstation (Smart Client / Mgmt Client): set the Folder filter to Root CA, pick the Root, click Install. Any Intermediates are installed automatically

What the installer does for you

Places the cert in the correct Windows store (LocalMachine\My for leaf certs, LocalMachine\Root for CA certs) and grants the matching XProtect service account the private-key ACL so the service can read it.

Manual export

Select certs in the Overview pane and click Export. PFX includes the private key (with optional password); cert-only formats (PEM / DER / .crt) are also available.

Role permissions

Each PKI kind has its own Read and Edit permission, granted per role under Security > Roles > [Role] > MIP > PKI > [kind]. Without Read on the matching kind, items are hidden in the Mgmt Client AND inaccessible via the Configuration API (PowerShell Get-ConfigurationItem, REST mipItems, MIP SDK clients), so private keys cannot be extracted by users who lack the grant.

Kind	Read grants...	Edit grants...
Root Certificate	Read certs and private keys in the Root CA folder.	Create, modify, and delete Root CAs.
Intermediate Certificate	Read certs and private keys in the Intermediate folder.	Create, modify, and delete Intermediates.
HTTPS Certificate	Read certs and private keys in the HTTPS folder.	Create, modify, and delete HTTPS certs.
802.1X Certificate	Read certs and private keys in the 802.1X folder.	Create, modify, and delete 802.1X certs.
Service Certificate	Read certs and private keys in the Service folder.	Create, modify, and delete Service certs.

The Overview node is visible as long as the role has Read on at least one kind; the cert grid filters per-row by the same per-kind permissions. The PKI Cert Installer EXE talks to the same REST surface, so the same permissions decide which certs an installer operator can deploy on a given XProtect server.

Treat Root CA Read as the most sensitive grant

Anyone with Root CA Read can export the private key that signs your entire chain. A common pattern is to grant Root Read only to the security team, Intermediate Read to cert operators, and Service / HTTPS / 802.1X Read to installer operators.

Storage and security notes

• Cert and key bytes are stored as PKCS#12 (PFX) on the MIP item, base64-encoded. Any user with Read on the matching kind can export the private key, so keep that grant tight (see Role permissions).
• The plugin does not auto-renew. Watch Remaining in the Overview; generate a fresh cert before expiry and re-deploy with the Cert Installer.
• Deleting a CA item is blocked while other certs in the vault still reference its thumbprint as their issuer. Delete the dependents (or re-issue them against a different CA) first.

Troubleshooting

Problem	Fix
PKI node not visible in Mgmt Client	Check role permissions. Grant at least one Read … action under MIP > PKI.
Cert Installer can't connect	Verify the Management Server hostname/port and that the signed-in user has PKI read permissions. Check installer.log via the Help dialog's Open log folder button.
Installed cert not picked up by service	Open the Server Configurator on that machine and apply the cert. The installer only places the cert in the store, the Configurator wires it to the service.
Auto setup did not create a cert for a service	The service must be registered with the Management Server (visible under Recording Servers / Mobile Servers / etc.). Re-run Auto setup after the service is registered.