Thank you very much for your effort, I hope it helps someone.
Unfortunately it doesn't help me because my DVR won't accept self-signed certificates (I could hack in and put single CA there, but I definitely wouldn't like to add every camera cert to OS trust store), I use Synology Surveillance...