Setting ssl/https

[feichter]

What do I need to add to motion.conf to make it stream in https?

This is what I have added, but it doesn't work.

stream_tls on
webcontrol_tls on
webcontrol_key /etc/motion/motion.key
webcontrol_cert /etc/motion/motion.crt

I have created the key and certificate with:
sudo openssl req -new -key /etc/motion/motion.key -out /etc/motion/motion.crt

Is there a proper tutorial anywhere?

many thanks!

[Mr-Dave]

That looks right. This is the link to my instructional videos. Note that while the videos were created using an older version of Motion, the setup would be the same.

If you post the log output from using the configuration parameters referenced, it may provide some insight into why it isn't working.

[feichter]

Thanks for your quick reply.

Not quite working...
I think it's got something to do with either the permissions of the crt and key files OR the path.

This is what the log file says:
[0:motion] [NTC] [ALL] [Mar 14 03:52:07] sig_handler: Received signal 15.
[1:ml1] [NTC] [ALL] [Mar 14 03:52:07] motion_loop: Thread exiting
[1:ml1] [NTC] [VID] [Mar 14 03:52:07] vid_close: Cleaning up V4L2 device
[1:ml1] [NTC] [VID] [Mar 14 03:52:07] v4l2_cleanup: Closing video device /dev/video0
[0:motion] [NTC] [ALL] [Mar 14 03:52:08] main: Threads finished
[0:motion] [NTC] [ALL] [Mar 14 03:52:08] main: Motion terminating
[0:motion] [NTC] [ALL] [Mar 14 03:52:08] motion_remove_pid: Closing logfile (/var/log/motion/motion.log).
[0:motion] [NTC] [ALL] [Mar 14 03:52:13] motion_startup: Motion 4.7.0 Started
[0:motion] [NTC] [ALL] [Mar 14 03:52:13] motion_startup: Using default log type (ALL)
[0:motion] [NTC] [ALL] [Mar 14 03:52:13] motion_startup: Using log type (ALL) log level (NTC)
[0:motion] [ERR] [ALL] [Mar 14 03:52:13] myfopen: Error opening file /home/pi/etc/motion/motion.crt with mode rbe: Permission denied
[0:motion] [ERR] [ALL] [Mar 14 03:52:13] myfopen: Error opening file /home/pi/etc/motion/motion.key with mode rbe: Permission denied
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_start_strm: Starting all camera streams on port 8081
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_mhd_checktls: SSL/TLS requested but no cert file provided. SSL/TLS disabled
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_mhd_checktls: SSL/TLS requested but no key file provided. SSL/TLS disabled
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_strm_ntc: Started camera 0 stream on port 8081
[0:motion] [ERR] [ALL] [Mar 14 03:52:13] myfopen: Error opening file /home/pi/etc/motion/motion.crt with mode rbe: Permission denied
[0:motion] [ERR] [ALL] [Mar 14 03:52:13] myfopen: Error opening file /home/pi/etc/motion/motion.key with mode rbe: Permission denied
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_start_ctrl: Starting webcontrol on port 8080
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_mhd_checktls: SSL/TLS requested but no cert file provided. SSL/TLS disabled
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_mhd_checktls: SSL/TLS requested but no key file provided. SSL/TLS disabled
[0:motion] [NTC] [STR] [Mar 14 03:52:13] webu_start_ctrl: Started webcontrol on port 8080
[0:motion] [NTC] [ENC] [Mar 14 03:52:13] ffmpeg_global_init: ffmpeg libavcodec version 59.37.100 libavformat version 59.27.100
[0:motion] [NTC] [ALL] [Mar 14 03:52:13] translate_init: Language: English
[0:motion] [NTC] [ALL] [Mar 14 03:52:13] motion_start_thread: Camera ID: 0 is from /etc/motion/motion.conf
[0:motion] [NTC] [ALL] [Mar 14 03:52:13] motion_start_thread: Camera ID: 0 Camera Name: (null) Device: /dev/video0
[0:motion] [NTC] [ALL] [Mar 14 03:52:13] main: Waiting for threads to finish, pid: 2393
[1:ml1] [NTC] [ALL] [Mar 14 03:52:13] motion_init: Camera 0 started: motion detection Enabled
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] vid_start: Opening V4L2 device
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] v4l2_device_open: Using videodevice /dev/video0 and input -1
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] v4l2_device_capability: - VIDEO_CAPTURE
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] v4l2_device_capability: - STREAMING
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] v4l2_input_select: Name = "/base/soc/i2c0mux/i2c@1/ov5647@"- CAMERA
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] v4l2_norm_select: Device does not support specifying PAL/NTSC norm
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] v4l2_pixfmt_try: Testing palette YU12 (640x480)
[1:ml1] [NTC] [VID] [Mar 14 03:52:13] v4l2_pixfmt_set: Using palette YU12 (640x480)
[1:ml1] [NTC] [ALL] [Mar 14 03:52:13] image_ring_resize: Resizing pre_capture buffer to 1 items
[1:ml1] [NTC] [ALL] [Mar 14 03:52:14] image_ring_resize: Resizing pre_capture buffer to 4 items

And this is what I have in the .conf file:
stream_tls on
webcontrol_tls on
webcontrol_key /home/pi/etc/motion/motion.key
webcontrol_cert /home/pi/etc/motion/motion.crt

And this is the motion directory:
pi@raspberrypi:/etc/motion $ ls -l
total 32
-rw-r--r-- 1 root root 726 Aug 23 2024 camera1-dist.conf
-rw-r--r-- 1 root root 817 Aug 23 2024 camera2-dist.conf
-rw-r--r-- 1 root root 881 Aug 23 2024 camera3-dist.conf
-rw-r--r-- 1 root root 799 Aug 23 2024 camera4-dist.conf
-rw-r--r-- 1 root root 5249 Mar 14 03:48 motion.conf
-rw-r--r-- 1 root root 1756 Mar 13 20:02 motion.crt
-rw------- 1 root root 3272 Mar 13 20:01 motion.key

Many thanks for your help Mr-Dave !

[Mr-Dave]

Yes, that is a file permission problem. You will need to adjust the file permissions so that the user that is running Motion can read the file and eliminate these messages in the log.

[0:motion] [ERR] [ALL] [Mar 14 03:52:13] myfopen: Error opening file /home/pi/etc/motion/motion.crt with mode rbe: Permission denied
[0:motion] [ERR] [ALL] [Mar 14 03:52:13] myfopen: Error opening file /home/pi/etc/motion/motion.key with mode rbe: Permission denied

[feichter]

Again, thank you for all your help.

I got a bit further and the permission problem has gone away. However, still no image in ssl mode.

There is an image, if I comment out the last section of the motion.conf file like so:

# Added by GF
#stream_tls on
#webcontrol_tls on
#webcontrol_key /etc/motion/motion.key
#webcontrol_cert /etc/motion/motion.crt

This is the content of motion.conf:

# Rename this distribution example file to motion.conf
#
# This config file was generated by motion 4.7.0
# Documentation:  /usr/share/doc/motion/motion_guide.html
#
# This file contains only the basic configuration options to get a
# system working.  There are many more options available.  Please
# consult the documentation for the complete list of all options.
#

############################################################
# System control configuration parameters
############################################################

# Start in daemon (background) mode and release terminal.
daemon off

# Start in Setup-Mode, daemon disabled.
setup_mode off

# File to store the process ID.
; pid_file value

# File to write logs messages into.  If not defined stderr and syslog is used.
; log_file value
log_file /var/log/motion/motion.log

# Level of log messages [1..9] (EMG, ALR, CRT, ERR, WRN, NTC, INF, DBG, ALL).
log_level 6

# Target directory for pictures, snapshots and movies
; target_dir value

# Video device (e.g. /dev/video0) to be used for capturing.
video_device /dev/video0

# Parameters to control video device.  See motion_guide.html
; video_params value

# The full URL of the network camera stream.
; netcam_url value

############################################################
# Image Processing configuration parameters
############################################################

# Image width in pixels.
width 640

# Image height in pixels.
height 480

# Maximum number of frames to be captured per second.
framerate 15

# Text to be overlayed in the lower left corner of images
text_left CAMERA1

# Text to be overlayed in the lower right corner of images.
text_right %Y-%m-%d\n%T-%q

############################################################
# Motion detection configuration parameters
############################################################

# Always save pictures and movies even if there was no motion.
emulate_motion off

# Threshold for number of changed pixels that triggers motion.
threshold 1500

# Noise threshold for the motion detection.
; noise_level 32

# Despeckle the image using (E/e)rode or (D/d)ilate or (l)abel.
despeckle_filter EedDl

# Number of images that must contain motion to trigger an event.
minimum_motion_frames 1

# Gap in seconds of no motion detected that triggers the end of an event.
event_gap 60

# The number of pre-captured (buffered) pictures from before motion.
pre_capture 3

# Number of frames to capture after motion is no longer detected.
post_capture 0

############################################################
# Script execution configuration parameters
############################################################

# Command to be executed when an event starts.
; on_event_start value

# Command to be executed when an event ends.
; on_event_end value

# Command to be executed when a movie file is closed.
; on_movie_end value

############################################################
# Picture output configuration parameters
############################################################

# Output pictures when motion is detected
picture_output off

# File name(without extension) for pictures relative to target directory
picture_filename %Y%m%d%H%M%S-%q

############################################################
# Movie output configuration parameters
############################################################

# Create movies of motion events.
movie_output off

# Maximum length of movie in seconds.
movie_max_time 60

# The encoding quality of the movie. (0=use bitrate. 1=worst quality, 100=best)
movie_quality 45

# Container/Codec to used for the movie. See motion_guide.html
movie_codec mkv

# File name(without extension) for movies relative to target directory
movie_filename %t-%v-%Y%m%d%H%M%S

############################################################
# Webcontrol configuration parameters
############################################################

# Port number used for the webcontrol.
webcontrol_port 8080

# Restrict webcontrol connections to the localhost.
webcontrol_localhost on

# Type of configuration options to allow via the webcontrol.
webcontrol_parms 0

############################################################
# Live stream configuration parameters
############################################################

# The port number for the live stream.
stream_port 8081
#stream_port 2460

# Restrict stream connections to the localhost.
stream_localhost off

##############################################################
# Camera config files - One for each camera.
##############################################################
; camera /usr/etc/motion/camera1.conf
; camera /usr/etc/motion/camera2.conf
; camera /usr/etc/motion/camera3.conf
; camera /usr/etc/motion/camera4.conf

##############################################################
# Directory to read '.conf' files for cameras.
##############################################################
; camera_dir /usr/etc/motion/conf.d

# Added by GF
#stream_tls on
#webcontrol_tls on
#webcontrol_key /etc/motion/motion.key
#webcontrol_cert /etc/motion/motion.crt

And this is the content of the motion.log

[0:motion] [NTC] [ALL] [Mar 14 11:45:23] sig_handler: Received signal 15.
[1:ml1] [NTC] [ALL] [Mar 14 11:45:23] motion_loop: Thread exiting
[1:ml1] [NTC] [VID] [Mar 14 11:45:23] vid_close: Cleaning up V4L2 device
[1:ml1] [NTC] [VID] [Mar 14 11:45:23] v4l2_cleanup: Closing video device /dev/video0
[0:motion] [NTC] [ALL] [Mar 14 11:45:24] main: Threads finished
[0:motion] [NTC] [ALL] [Mar 14 11:45:24] main: Motion terminating
[0:motion] [NTC] [ALL] [Mar 14 11:45:24] motion_remove_pid: Closing logfile (/var/log/motion/motion.log).
[0:motion] [NTC] [ALL] [Mar 14 11:45:26] motion_startup: Motion 4.7.0 Started
[0:motion] [NTC] [ALL] [Mar 14 11:45:26] motion_startup: Using default log type (ALL)
[0:motion] [NTC] [ALL] [Mar 14 11:45:26] motion_startup: Using log type (ALL) log level (NTC)
[0:motion] [NTC] [STR] [Mar 14 11:45:26] webu_start_strm: Starting all camera streams on port 8081
[0:motion] [NTC] [STR] [Mar 14 11:45:26] webu_strm_ntc: Started camera 0 stream on port 8081
[0:motion] [NTC] [STR] [Mar 14 11:45:26] webu_start_ctrl: Starting webcontrol on port 8080
[0:motion] [NTC] [STR] [Mar 14 11:45:26] webu_start_ctrl: Started webcontrol on port 8080
[0:motion] [NTC] [ENC] [Mar 14 11:45:26] ffmpeg_global_init: ffmpeg libavcodec version 59.37.100 libavformat version 59.27.100
[0:motion] [NTC] [ALL] [Mar 14 11:45:26] translate_init: Language: English
[0:motion] [NTC] [ALL] [Mar 14 11:45:26] motion_start_thread: Camera ID: 0 is from /etc/motion/motion.conf
[0:motion] [NTC] [ALL] [Mar 14 11:45:26] motion_start_thread: Camera ID: 0 Camera Name: (null) Device: /dev/video0
[0:motion] [NTC] [ALL] [Mar 14 11:45:26] main: Waiting for threads to finish, pid: 2011
[1:ml1] [NTC] [ALL] [Mar 14 11:45:26] motion_init: Camera 0 started: motion detection Enabled
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] vid_start: Opening V4L2 device
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] v4l2_device_open: Using videodevice /dev/video0 and input -1
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] v4l2_device_capability: - VIDEO_CAPTURE
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] v4l2_device_capability: - STREAMING
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] v4l2_input_select: Name = "/base/soc/i2c0mux/i2c@1/ov5647@"- CAMERA
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] v4l2_norm_select: Device does not support specifying PAL/NTSC norm
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] v4l2_pixfmt_try: Testing palette YU12 (640x480)
[1:ml1] [NTC] [VID] [Mar 14 11:45:26] v4l2_pixfmt_set: Using palette YU12 (640x480)
[1:ml1] [NTC] [ALL] [Mar 14 11:45:27] image_ring_resize: Resizing pre_capture buffer to 1 items
[1:ml1] [NTC] [ALL] [Mar 14 11:45:27] image_ring_resize: Resizing pre_capture buffer to 4 items

Your help is very much appreciated !

[Mr-Dave]

Probably want to move the following section up in the configuration file to be before any camera specification lines.

# Added by GF
#stream_tls on
#webcontrol_tls on
#webcontrol_key /etc/motion/motion.key
#webcontrol_cert /etc/motion/motion.crt

Also, change the log level to "debug" (8), provide a screen shot of what the web page indicates for the stream page and finally, double check your setting versus those that were shown in the video.