motion not encrypted even with https

Question

Edit : I found a workaround, please see the Edit at the end.

I have a raspberry PI 3 running Raspbian Buster. I'm trying to set up motion 4.2.2 with 2 cameras to make a little surveillance system, and I need to stream it to the Internet so that I can monitor it when I'm not home. The problem is that I can't encrypt the video streams.

Actually there are parameters in motion to enable TLS (webcontrol_tls, stream_tls, webcontrol_cert and webcontrol_key) and I tried it with a self-signed certificate for testing. The pages are then accessible with HTTPS instead of HTTP so that's working. But when I click on the lock sign in firefox to see the encryption details of a streaming page, it tells me that the connection is not encrypted. However the web control page is correctly encrypted (firefox tells me it's using TLS 1.3 with a 128 bit key), but the streams are not, even though I'm connected in HTTPS.

I thought maybe I could use a reverse proxy like nginx to force the encryption between the client and the server, but it still doesn't work. I use proxy_pass to redirect to the streams but they are still not encrypted. Obvioulsy something happens here because with nginx, the web control page is now using a 256 bit key (instead of 128 when I directly connected to motion), but the streams are not affected.

Here is my nginx server block configuration :

server {
   listen       443 ssl default_server;
   server_name my_server;
   ssl                 on;
   ssl_certificate     /etc/ssl/certs/mycert.csr;
   ssl_certificate_key /etc/ssl/private/mykey.key;
   ssl_protocols       TLSv1.3;
   ssl_prefer_server_ciphers   on;
   ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

   root /var/www/html;
   index index.html;

   location / {
      proxy_pass https://192.168.1.210:8080;
   }

   location /pi/ {
      proxy_pass https://192.168.1.210:8081/101/stream;
   }

   location /usb/ {
      proxy_pass https://192.168.1.210:8081/102/stream;
   }
}

I also tried to not use tls in motion when using nginx but then the connections are not encrypted at all (even the web control page).

It doesn't really make sense to me as I thought that HTTPS always meant encrypted connection...

I don't know what I'm doing wrong, or if it just can't work at all.

Thank you for reading.

---

Edit

I was curious why the web control page, which displays thumbnails of all streams in real time, was correctly encrypted when it was configured for using TLS, but the stream pages were not.

So I tried to see the source code of the control page so that I could copy the interesting part (the streams) and it turns out that the streams thumbnails are just <img> elements with their src attribute set as the streams URLs.

So I created an empty HTML page with only this line : <img src=https://192.168.1.210:8081/101/stream /> and it works fine : firefox tells me the page really is encrypted with TLS 1.3.

I don't know what is wrong when using the stream URL directly... maybe different things happen in the backend, maybe firefox is handling things differently before displaying it, I don't know...

Anyway, I lost way too much time on this, but at least I'm relieved the solution is that simple to implement...

And thanks to @M. Rostami for helping ! I'm sorry I won't dig any further in technical stuff for now though.

Answer 1

The motion doesn't encrypt video streams. I mean, it hasn't an online video/FFmpeg/RTSP encryption feature As I read a long time ago, it's not related to https.
Motion sends video streams over a simple UDP connection, because of that, it's fast enough. So, imagine there is an encryptor/decryptor between this system. Check this link out for this case.

TLS operates over TCP that is for just the web page objects to make it HTTPS (secure). As I mentioned, motion transmit video streams over a UDP connection. The TLS option which you enabled is not for the video streams. If you want to encrypt this connection secure, you must utilize DTLS (makes your UDP connection secure), SRTP, RTSP, etc. Check these links out for this case.
Encrypted Video Streaming Encrypted Video Streaming: VdoCipher & Others

---

However, you can do it by yourself but take note that it's a bit complex.