Icecast - Mar 2020 - SSL Question

On Sat, Mar 07, 2020 at 07:16:51AM +1300, Gavin Stephens
wrote:
> FYI Chrome just sits there saying establishing secure connection. I've
just
> installed Ice on another machine and copied over the icecast.pem file and
> un-remarked the port and path areas for SSL on port 443 (not 8443).  Same
> result.
I have:

    <listen-socket>
        <port>8443</port>
        <bind-address>::</bind-address>
        <ssl>1</ssl>
    </listen-socket>

    <paths>
        <ssl-certificate>/etc/icecast2/icecast.pem</ssl-certificate>
    </paths>

And it's definitely working with Chromium 80.0.3987.132.

Is there anything else listening on port 443/tcp on that server?

-- 
Paul Martin <pm at nowster.me.uk>

Sorry for the late update. I didn't realise the replies came and went off
list regarding this.

 I had another suggestion made to me it could still be bad pem files and to try
converting them to pfx then back to pem files, which I did, and fortunately this
fixed it.

 The error message I was getting in the Icecast log was about no compatible ssl
port.  I assumed this was something more complex than a bad certificate since an
error message to that effect would have been easier to figure out.

 I took the certificate and private key .pem files, added them together but it
didn't work until the conversion to pfx and back.

 Thanks for the reply though.

Cheers,
Gavin.









On 9 March 2020 4:03:00 AM NZDT, Paul Martin <pm at nowster.me.uk>
wrote:
>On Sat, Mar 07, 2020 at 07:16:51AM +1300, Gavin Stephens wrote:
>> FYI Chrome just sits there saying establishing secure connection.
>I've just
>> installed Ice on another machine and copied over the icecast.pem file
>and
>> un-remarked the port and path areas for SSL on port 443 (not 8443). 
>Same
>> result.
>
>I have:
>
>    <listen-socket>
>        <port>8443</port>
>        <bind-address>::</bind-address>
>        <ssl>1</ssl>
>    </listen-socket>
>
>    <paths>
>       
<ssl-certificate>/etc/icecast2/icecast.pem</ssl-certificate>
>    </paths>
>
>And it's definitely working with Chromium 80.0.3987.132.
>
>Is there anything else listening on port 443/tcp on that server?
>
>-- 
>Paul Martin <pm at nowster.me.uk>
>_______________________________________________
>Icecast mailing list
>Icecast at xiph.org
>http://lists.xiph.org/mailman/listinfo/icecast
-- 
Sent from Open Mail on Android.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.xiph.org/pipermail/icecast/attachments/20200309/bd76ed07/attachment.html>

On 08/03/2020 16:24, Gavin Stephens wrote:
> Sorry for the late update. I didn't realise the replies came and went
> off list regarding this.
>
> I had another suggestion made to me it could still be bad pem files
> and to try converting them to pfx then back to pem files, which I did,
> and fortunately this fixed it.
>
> The error message I was getting in the Icecast log was about no
> compatible ssl port. I assumed this was something more complex than a
> bad certificate since an error message to that effect would have been
> easier to figure out.
>
> I took the certificate and private key .pem files, added them together
> but it didn't work until the conversion to pfx and back.
Interesting. Can you show us the difference in .pem files before and
after conversion (without revealing your private key, of course)?

Regards,

 - Jeroen


-- 
Bankai Software bv
Jeroen van Oosten
Telefoon: 088-2344999
E-mail: jvoosten at bankai.nl
KvK inschrijving: 67066267
PGP key: B2308F8E

"If you think it's expensive to hire a professional to do the job, wait
until you hire an amateur." --Red Adair