Q-SYS Connect: Virtual UC Controller

The Virtual UC Controller is a Q-SYS Designer component that works in conjunction with Q-SYS Connect to integrate Windows-based room compute devices such as, Zoom Rooms into the Q-SYS ecosystem. It creates a virtual display on the compute, streams that display as a Mediacast video feed, and enables touch feedback from a Q-SYS TSC-101-Gen 3 touchscreen. This allows Q-SYS touch controllers to function as native UC interfaces without additional hardware.

The Virtual UC Controller is a sub-component of the Q-SYS Connect component. It appears in Inventory only when the Room Type property is set to Zoom Room.

Note: The Q-SYS Connect version must match the Q-SYS OS firmware version. Refer to the compatibility table in the Q-SYS Connect Release Notes for correct pairing.

Q-SYS communication between Cores and Peripherals can be secured by encryption and mutual authentication using X.509 certificates. Secure mode of communication applies to two types of connections:

• Control connections – Design controls and other control traffic between cores and peripherals.

• Device-to-device web connections – Operations such as design deploy, firmware update, device status, and other web/API based interactions.

In secure mode, two devices can communicate securely only if they can mutually authenticate each other:

• Each device must find the peer’s certificate in its trusted list.

• The peer must prove ownership of the private key associated with the certificate it presents.

This mutual authentication is what ensures that both ends of the connection are who they claim to be.

Q-SYS manages device trust using three lists: Trusted, Pending, and Declined certificates.

Trusted

In typical configurations, certificates can be added to the trusted list automatically. By default:

• The Core’s trusted list includes all peripheral certificates.

• Each Peripheral automatically trusts the Core’s certificate (or both certificates in a redundant core pair).

This allows cores and peripherals to establish secure communication seamlessly without user intervention.

Pending

If automatic trust is not possible—for example, because of a configuration or policy restriction—the peer’s certificate is placed on the Pending list for manual approval. Once a Peripheral’s trusted list includes at least one certificate, it switches to secure mode and restricts communication to only the associated core (or core pair).

Declined Certificates

Certificates that are on, or that chain to one on, the Declined list are denied communication entirely. They are not allowed onto the Pending list and cannot be used to establish secure communication.

In a redundant Core pairs:

• The two Cores must first establish mutual trust with each other.

• After that trust is in place, both Core certificates are shared with Peripherals.

• Peripherals then add both certificates to their trusted lists, allowing them to maintain secure communication if a failover occurs from the primary Core to the backup.

1. Update the firmware on all Q-SYS devices to version 10.0 (or higher) to support secure communication.

2. Install the required certificates on the Core and Peripherals. If no new certificates are installed, the currently installed ones will be used. Refer to Network > Certificates for instructions on installing certificates.

3. Set up Access Control of all Cores and all Peripherals. For more details, see Access Management > Usersin Core Manager and Device Password in Peripheral Manager.

Note: Since primary and backup (redundant) Cores automatically sync, ensure Access Control is enabled on the backup Core.

Trust On First Usage (TOFU)

• Peripheral

A Peripheral with TOFU enabled will automatically add a Core's certificate to its trusted list if the list is empty. Once secured, the Peripheral requires manual approval for any new Core certificates via Peripheral Manager.

• Core

The Core adds each Peripheral's certificate to its trusted list automatically. If a Peripheral device is swapped but retains the same name, manual approval for the new certificate is needed through Core Manager.

Rollover

Disabled in the Core by default. This option, enabled by default on Peripherals but not on the Core, facilitates automatic replacement of certificates, avoiding need for manual approvals when a certificate is updated.

1. Disable Non-Authentication-Supporting Networking Services.

Navigate to Network > Services > Managementt and disable the following services:

• Q-SYS External Control Protocol - ASCII

• Q-SYS Remote Control Protocol - JSONRPC

Note: Consider certificate expiration by checking the 'Verify Validity Period' to block expired certificates from authenticating.

1. Click the Enable Secure Communication button on the Core to initiate secure mode.

1. To disable secure communication, click Disable Secure Communication on the Core. The core attempts to withdraw its certificate from the peripherals. By clearing a peripheral’s trusted list, the device reverts to non-secure mode of communication.

2. If some peripherals do not switch to non-secure mode automatically, manually clear their trusted lists. In scenarios where a peripheral trusts devices beyond the current core (or redundant core pair), the current core does not revoke those certificates. You may need to remove trust for that peripheral from other cores as well to maintain consistent security across different Q-SYS setups.

Note: If you plan to downgrade the Q-SYS system to firmware that does not support secure communication, ensure that secure mode is disabled on the core and that all peripheral trusted lists are cleared. A core running firmware that does not support secure communication will fail to connect to peripherals still operating in secure mode.

1. Ensure secure connections are established between Cores and Peripherals.

• If automatic trust does not apply, review pending certificates and verify their authenticity by comparing fingerprints. See Network > Certificates for more information.

• To ensure Cores and Peripherals engage in a trusted relationship, visit the Troubleshooting section below.

Behavior in Special Scenarios

• Once secure mode is activated, you cannot remove the device password without first disabling secure mode.

• Automatic rollover may fail if a device installs a new certificate while its peer is offline. When rollover fails, manual approval of the certificate is required.

• For inter-design communications, manual certificate exchanges are necessary to gain trust.

• In a setup with two Cores where Secure Communication is enabled on only one, if a Peripheral is added to both designs, the core with Secure Communication will establish a connection, while the other core will show Authentication failure.

• Security configuration options are synced between active and backup Cores: you can change the security configuration only on the active core. Trusted lists of certificates are also synced between active and backup cores; only the certificates of the currently running design are exchanged between the cores. At all times, the active Core ensures that trusted Peripherals also trust the backup Core.

Security Best Practices

• Disabling both TOFU and Rollover is advised if there is any perceived security threat during deployment.

The Secure Communication page in the side navigation lets you configure these behaviors and manage certificate trust:

• The Security Options section controls how trust is established and maintained.

• The Trusted Certificates, Pending Certificates, and Declined Certificates tabs show the current trust state for connected devices and let you upload, approve, or decline certificates.

The following sections describe each security option and certificate list in more detail.

Enable Secure Communication Button

Allows administrators to enforce HTTPS and related secure protocols for management traffic.

Security Options

Defines how trust and certificate validation are handled.

• Trust On First Use

Automatically establishes trust with a remote device the first time it connects.

• Rollover

Enables automatic replacement of an existing trusted certificate with the new one.

• Verify Validity Period

Stop trusting devices with expired certificates.

• Control Server Authentication

Requires the client to provide a certificate and verify it against the trusted list.

Certificate Management

Below the security options, there are three tabs for managing certificates:

• Trusted Certificates

Displays certificates that have been accepted and are currently trusted.

• Pending Certificates

Shows certificates awaiting approval.

• Declined Certificates

Lists certificates that were explicitly rejected to communicate with this device.

Upload Certificate Button

Allows you to manually add a certificate to the trusted list. This is useful for preloading certificates before deployment.

Decline Button

Allows you to reject a pending certificate request.

When devices do not trust each other, a control connection cannot be established. In this case, the device status shows Fault – Authentication Failure. You can examine the Core’s log for error messages that describe the cause of the authentication failure for each device.

Common causes and resolutions:

Device password not set

Secure mode is not available for devices without a user password.

• Ensure Access Control is enabled on both Cores in a redundant pair.

• Verify that all peripherals have a user password set.

Certificate pending manual approval

The offered certificate may be on the Pending list in the core or peripheral.

• In Core Manager and Peripheral Manager, review the list of pending certificates.

• Approve the certificate only after confirming that its fingerprint is correct.

Certificate declined

The offered certificate may be on the Declined list.

• In Core Manager and Peripheral Manager, review declined certificates.

• Remove any declined certificate that was added by mistake so it can move to Pending or Trusted.

Certificate expired

The offered certificate may have expired.

• Regenerate and install a new certificate on the device whose certificate has expired.

Redundant cores not trusted by each other

In a redundant system, the two Cores must first trust each other before Peripherals can fully establish trust.

• Verify that primary and backup Core certificates are on each other’s trusted lists.

• Once mutual trust is established between the Cores, trust establishment with peripherals is unblocked.

Q-SYS Connect Properties

Name

The Name may contain ASCII letters 'a' through 'z' (case-insensitive), the digits '0' through '9', and the hyphen. Names cannot begin or end with a hyphen. No other symbols, punctuation characters, or blank spaces are permitted.

Location

User-defined name that groups the component with other components in the same physical location, or in the same organizational scheme.

Is Network Redundant

Select whether the device is connected to redundant networks.

Is Required

When enabled, and the device is not found on the network, the device is reported as 'Missing', which is an error condition. This is the default behavior. When disabled, and the device is not found on the network, the device is reported as 'Not Present', which is not an error condition.

Display On Demand

Controls when the Virtual UC Controller creates a virtual display on the Zoom Rooms compute device and starts streaming it to Q‑SYS.

IP Streaming

Defines how the Q‑SYS Connect component handles its network transport and streaming behavior.

Maintain Primary Display

Determines whether the virtual display created by the Virtual UC Controller attempts to become the primary display on the Zoom Rooms compute device.

Room Type

Specifies the UC platform type.

Zoom Room – Configures Q‑SYS Connect to work with Zoom Rooms. This enables the Virtual UC Controller sub‑component in the Inventory and allows a Q‑SYS TSC‑101-Gen 3 controller to act as a native Zoom Rooms controller via the virtual display and touchback.

Graphic Properties

Label

User-defined text that appears next to the component on the Schematic. Changing the label does not affect the component name or system behavior.

Position

Specifies the X and Y coordinates of the component on the Schematic. The values update automatically when you move the component, and can be edited to place the component at an exact location.

Fill

Sets the background color of the component block on the Schematic. This is for visual organization only and does not affect system operation.

Script Access

Code Name

Displays the currently assigned name for control access. You can use the auto-assigned name or customize it. Q-SYS will automatically check all Code Names in the design to ensure name is unique.

Script Access

Defines whether the component will be accessible by script and/or externally, or not at all. Choices include All, External, None (default), and Script.

Tip: Use Script Programmer Mode to quickly view the Script Access setting directly on the component in the design schematic without the need to disconnect from the Q-SYS Core processor.

Virtual UC Controller Status

Component status is conveyed with the Status LED and Status box, which uses both color and text to indicate the current condition:

  • OK: The device is functioning normally.
  • Initializing: The device is in the process of a firmware, patch, or configuration update, or the design is starting.
  • Compromised: The device is functioning, but a non-fatal problem exists. Refer to the Status box for details.
  • Missing: The device cannot be discovered.
  • Fault: The device is malfunctioning or is not properly configured. Refer to the Status box for details.
  • Unknown: This status appears during a Core reboot (for example, during a firmware update), or when a design is being uploaded to the Core and before it has started running.
  • Not Present: If applicable to the device, this status appears when the device is not connected to the network and its Is Required component property is set to 'No'. This status also appears if the device component's Dynamically Paired property is set to 'Yes', pairing has not been assigned in Core Manager, and the device component's Is Required property is set to 'Yes'. See Dynamic Pairing.

Mediacast Stream Controls

Identify

When pressed, shows an ID image with the discovery name on the virtual display.

Enable

When pressed, turns the virtual display on or off.

Display Format

Sets the virtual display resolution and framerate.

Preview

A preview of the virtual display. Updates once per second (1x / second).

Display

Enabled

When pressed, turns the virtual display, on / off.

Format

Sets or reads the virtual display's resolution and frame rate using an integer index.

Hotplug Request

Triggers or reports a hotplug event on the virtual display. Simulates connecting / disconnecting the display.

Identify

Triggers or reads the identify function. Shows an identification image with the discovery name on the virtual display.

Status

Reports the current operational status of the virtual display. Output only.

Type

Sets or reads the type of virtyal display being used.

Mediacast

Bitrate (Mbps)

Sets or reads the bitrate in Mbps, of the Mediacast stream from the virtual display.

Format

Sets or reads the codec / format of the Mediacast stream.

I-Frame Rquest

Requests an intra-frame (I-Frame) from the Mediacast encoder to improve stream recovery after packet loss.

RTSP URL

Read-only output providing the full RTSP URL of the Mediacast stream, usable with compatible players or for routing. Output only.

Pin Name Value String Position Pins Available
Display Enabled

0

1

false

true

0

1

 Input / Output
Display Format

Integer / index

format string

0

 Input / Output
Display Hotplug Request

0

1

false

true

0

1

 Input / Output
Display Identity

0

1

false

true

0

1

 Input / Output
Display Status

0

1

status string

0

1

 Output
Display Type

Numeric type

type string

0

 Input / Output
Mediacast Bitrate (Mbps) Numeric bit rate value bit rate as text

0

 Input / Output
Mediacast Format Numeric / codec numeric / codec

-

 Input / Output
Mediacast I-Frame Request

0

1

false

true

0

1

 Input / Output
Mediacast RTSP URL N/A full RTSP URL

0

 Output