Hi
These instructions are very useful, as previously shared:
- https://serverok.in/centovacast-enable-ssl-on-icecast
However, I think this step caused me problems using Letsencrypt (LE) and
the icecast.pem file might have been in error:
Paste your SSL in following order
1) Your private key
2) Your SSL cert
3) CA Bundle
I don't think LE creates a 'CA Bundle'. Following some other
instructions I
was making the *.pem file like this:
cat cert.pem privkey.pem > icecast.pem *<= this is not a good method*
Test your stream using this:
curl -v https://example.com:8001/mountpoint
If curl is not happy with your SSL cert it will throw an error like this:
[chip at machine ~]$ curl -v https://example.com:8001/mountpoint
About to connect() to example.com port 8001 (#0)
Trying 192.168.1.50… connected
Connected to example.com (192.168.1.50) port 8001 (#0)
Initializing NSS with certpath: sql:/etc/pki/nssdb
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
Peer’s certificate issuer is not recognized: ‘CN=Let’s Encrypt
Authority X3,O=Let’s Encrypt,C=US’
NSS error -8179
Closing connection #0
Peer certificate cannot be authenticated with known CA certificates
curl: (60) Peer certificate cannot be authenticated with known CA
certificates
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a
"bundle"
of Certificate Authority (CA) public keys (CA certs). If the default bundle
file isn't adequate, you can specify an alternate file using the --cacert
option. If this HTTPS server uses a certificate signed by a CA represented
in the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might not
match the domain name in the URL). If you'd like to turn off curl's
verification of the certificate, use the -k (or --insecure) option.
If you are using LE then this, IMHO, is a *better way* to make the
icecast.pem file:
cat privkey.pem fullchain.pem > icecast.pem
The above creates a more 'correct' SSL cert which, for example, Alexa
devices are able to stream.
And you can check your SSL stream here:
- https://check-your-website.server-daten.de/?q
Thanks
Chip Scooter
On Thu, 6 Feb 2020 at 07:58, H. van de Ridder <hvdridder at solcon.nl>
wrote:
> Thanks a lot.
> This manual solves my problem.
>
> Kind regards,
> Henk
> ------------------------------
>
> ------------------------------
>
>
> ----- Original Message ----
> From: Chip <chiapas at aktivix.org>
> To: Icecast streaming server user discussions <icecast at xiph.org>
> Sent: Woe, 05 Feb 2020 23:57
> Subject: Re: [Icecast] Icecast streaming https
>
> Of course...
>
> Best print it to PDF in case it ever disappears!
>
> All the best
>
> Chip Scooter
>
> On Wed, 5 Feb 2020 at 22:07, Richard Elen <relen at brideswell.com>
wrote:
>
>> That's a useful site! Thanks for that!
>>
>> R
>> On 05-Feb-20 18:52, Chip wrote:
>>
>> Here you go:
>>
>> - https://serverok.in/centovacast-enable-ssl-on-icecast
>>
>> No problem, you're welcome!
>>
>> Chip Scooter
>>
>> _______________________________________________
>> Icecast mailing list
>> Icecast at xiph.org
>> http://lists.xiph.org/mailman/listinfo/icecast
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.xiph.org/pipermail/icecast/attachments/20200207/98db7856/attachment.html>
