Is SSL needed for connecting to my DVR System?

Question

I was wondering if SSL is necessary to connect to my DVR System, by default, which can't be changed, I can connect to my DVR System with the help of dyndns.com. But going to the domain doesn't show any SSL settings.

I was also wondering if I can use my own domain (sub-domain) rather than dyndns.com to achieve this? Would it be safer using my own domain? I can probably use .htaccess to deny all IP's other than certain ones too.

Answer 1

The DVR system should have an HTTPS support, otherwise it may not be supported at all. Other than seeing this from your DVR's control panel, you can easily check this by going to https://ip.address.your.dvr/

Yes. you can use your own domain by creating an A RECORD in your DNS server pointing to your DVR's IP address given that your IP is static. The only reason why Dyndns option is built-in for every DVR is because of dynamic IP usually shipped with Internet connections at home.

You cannot use .htaccess simply because the DVR's internal is firmware.

Answer 2

Whether or not you need to enable SSL/TLS to connect to your DVR is up to you: it should be based on your evaluation of the risk. Presumably, your DVR is located behind a reverse NAT router. Generally speaking, it's a good idea to consider using HTTPS indeed, especially for something that's going to connect to a device within your LAN from outside.

If you DVR itself doesn't have any HTTPS settings, such a configuration might not be directly possible. You may have to set up a reverse proxy to do so, which is a bit more involved. Some routers might let you do that (especially if you can install your own system, such as OpenWRT or DD-WRT, ...), or you could also run your own server (acting as a reverse proxy) on another device within your LAN (you'd have NAT Router <--port-forward--> HTTPS server <--reverse-proxy--> DVR HTTP server).

In terms of DNS records, you can issue your certificate to something.yourdomain.example, then have something.yourdomain.example be a CNAME record to youraccount.dyndns.org, where you would update that DynDNS record regularly (perhaps via an application already provided with your DVR or router). Since the host name verification is made according to the host name requested by the client (see RFC 2818 Section 3.1 or RFC 6125), this will work fine.

.htaccess is a local configuration file used by Apache Httpd. It may work if your DVR uses Apache Httpd and lets you access it. Whatever it uses might have other configuration files instead. It all depends on the equipment you have.