Requirements<\/h3>\n\n- Ubuntu Server with Wowza 4.8.23+2 installed. <\/li>\n
- Open TCP ports 80, 443 and 8090 (TCP\/IN) in your firewall. We need them to be able to request and validate the SSL certificate.<\/li>\n
- A valid DNS name that points to your wowza server. <\/li>\n<\/ul>\n
In case you used the installer from part 1<\/a> or part 1.1<\/a> of the turorial series, SSL is already pre-configured in the Firewall. <\/p>\nImportant<\/h3>\n
In the next steps i will create the SSL on wowza.vanmarion.nl. Make sure you change this url to your setup. <\/p>\n
Step 1 – install Snap and certbot<\/h3>\n
just follow these commands and run as sudo<\/p>\n
# install snap\r\nsudo apt install snapd -y\r\nsudo systemctl enable --now snapd.socket\r\nsudo ln -s \/var\/lib\/snapd\/snap \/snap\r\n\r\n# remove certbot-auto and Certbot packages\r\nsudo apt remove certbot\r\n\r\n# install certbot\r\nsudo snap install --classic certbot\r\n\r\n# cereate a symlink\r\nsudo ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/pre>\nStep 2 – request the SSL certificate<\/h3>\n
We now will request an SSL certificate for our domainname.<\/p>\n
sudo certbot certonly --standalone -d wowza.vanmarion.nl --key-type rsa<\/pre>\nSet an emailadress where letsencrypt can send mails to and let you know if the certificate needs renewal. <\/p>\n
#Saving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\r\n#Enter email address (used for urgent renewal and security notices)\r\n# (Enter 'c' to cancel): <set-email-address>\r\n<\/pre>\nAnswer the next questions with yes and no<\/p>\n
#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#Please read the Terms of Service at\r\n#https:\/\/letsencrypt.org\/documents\/LE-SA-v1.3-September-21-2022.pdf. You must\r\n#agree in order to register with the ACME server. Do you agree?\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#(Y)es\/(N)o: y\r\n\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#Would you be willing, once your first certificate is successfully issued, to\r\n#share your email address with the Electronic Frontier Foundation, a founding\r\n#partner of the Let's Encrypt project and the non-profit organization that\r\n#develops Certbot? We'd like to send you email about our work encrypting the web,\r\n#EFF news, campaigns, and ways to support digital freedom.\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#(Y)es\/(N)o: n\r\n\r\n<\/pre>\nThe certificate now gets created. You should see something like this:<\/p>\n
#Account registered.\r\n#Requesting a certificate for wowza.vanmarion.nl\r\n\r\n#Successfully received certificate.\r\n#Certificate is saved at: \/etc\/letsencrypt\/live\/wowza.vanmarion.nl\/fullchain.pem\r\n#Key is saved at: \/etc\/letsencrypt\/live\/wowza.vanmarion.nl\/privkey.pem\r\n#This certificate expires on 2023-09-17.\r\n#These files will be updated when the certificate renews.\r\n#Certbot has set up a scheduled task to automatically renew this certificate in the background.\r\n\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#If you like Certbot, please consider supporting our work by:\r\n# * Donating to ISRG \/ Let's Encrypt: https:\/\/letsencrypt.org\/donate\r\n# * Donating to EFF: https:\/\/eff.org\/donate-le\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n<\/pre>\nWell done. You have succesfully created the Letsencrypt certificate. Now we will convert the certificate to a JKS format which we need in the next steps<\/p>\n
Step 3 – Letsencrypt converter<\/h3>\n
Follow the next series of commands <\/p>\n
#- Convert the SSL certificate so we can use it in Wowza. Letsencrypt converter (creation JKS file). \r\n#- Credits to Robymus: https:\/\/github.com\/robymus\r\n\r\ncd \/usr\/local\/WowzaStreamingEngine\/lib \r\nsudo wget https:\/\/github.com\/robymus\/wowza-letsencrypt-converter\/releases\/download\/v0.2\/wowza-letsencrypt-converter-0.2.jar\r\nsudo java -jar wowza-letsencrypt-converter-0.2.jar -v \/usr\/local\/WowzaStreamingEngine\/conf\/ \/etc\/letsencrypt\/live\/\r\n\r\n# 2 files should have been created. a .jks and a .txt file. Read the txt file and copy the contents in a temporary notepad\r\n<\/pre>\nNow when read the created jks txt file we see this:<\/p>\n
cat \/usr\/local\/WowzaStreamingEngine\/conf\/jksmap.txt\r\n\r\n#example output: \r\nSUB.DOMAIN.EXT={\"keyStorePath\":\"\/usr\/local\/WowzaStreamingEngine\/conf\/wowza.vanmarion.nl.jks\", \"keyStorePassword\":\"secret\", \"keyStoreType\":\"JKS\"}<\/pre>\nCopy this line in a notepad or editor of your choice. We will need this information in the next steps. <\/p>\n
Step 4 – Enable SSL module in VHost.xml<\/h3>\n
We will enable 443 Module by removing the <!– and –> tags around the <HostPort> tag<\/p>\n
sudo vi \/usr\/local\/WowzaStreamingEngine\/conf\/VHost.xml<\/pre>\nSee the image below for the desired setup. <\/p>\n
1 and 2: Remove the <!– and –> tags<\/p>\n
3 and 4. Only Change only the keyStorePath and keyStorePassword to the ones from the jks file (see step 3). The rest doesn’t have to be changed<\/p>\n
![\"\"](\"https:\/\/vanmarion.nl\/blog\/wp-content\/uploads\/2023\/06\/VHost-ssl-300x176.jpg\")
<\/a><\/p>\n <\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
<\/p>\n
Original: <\/p>\n
<SSLConfig>\r\n <KeyStorePath>${com.wowza.wms.context.VHostConfigHome}\/conf\/keystore.jks<\/KeyStorePath>\r\n <KeyStorePassword>[password]<\/KeyStorePassword>\r\n <KeyStoreType>JKS<\/KeyStoreType>\r\n <DomainToKeyStoreMapPath><\/DomainToKeyStoreMapPath>\r\n <SSLProtocol>TLS<\/SSLProtocol>\r\n <Algorithm>SunX509<\/Algorithm>\r\n <CipherSuites><\/CipherSuites>\r\n <Protocols><\/Protocols>\r\n<\/SSLConfig><\/pre>\nto: <\/p>\n
** make sure to change wowza.vanmarion.nl to your domainname<\/p>\n
<SSLConfig>\r\n <KeyStorePath>${com.wowza.wms.context.VHostConfigHome}\/conf\/wowza.vanmarion.nl.jks<\/KeyStorePath>\r\n <KeyStorePassword>secret<\/KeyStorePassword>\r\n <KeyStoreType>JKS<\/KeyStoreType>\r\n <DomainToKeyStoreMapPath><\/DomainToKeyStoreMapPath>\r\n <SSLProtocol>TLS<\/SSLProtocol>\r\n <Algorithm>SunX509<\/Algorithm>\r\n <CipherSuites><\/CipherSuites>\r\n <Protocols><\/Protocols>\r\n <AllowHttp2>false<\/AllowHttp2>\r\n<\/SSLConfig><\/pre>\nNote: if you want to see line numbers when you have opened your file just hit <\/p>\n
:set number<\/pre>\nNow save the file.<\/p>\n
Step 5 – Edit tomcat properties<\/h3>\n
In order to run the Enginemanager on port 8090 change this file and uncomment the first 3 lines<\/p>\n
sudo vi \/usr\/local\/WowzaStreamingEngine\/manager\/conf\/tomcat.properties<\/pre>\nResult:<\/p>\n
httpsPort=8090\r\nhttpsKeyStore=\/usr\/local\/WowzaStreamingEngine\/conf\/wowza.vanmarion.nl.jks\r\nhttpsKeyStorePassword=secret\r\n#httpsKeyAlias=[key-alias]<\/pre>\nStep 6 – Edit startmgr<\/h3>\n
The second step is a bit more tricky. We will disable the http port and only allow https port 8090. Open the file startmgr.sh<\/p>\n
We will change the second CMD command. Make sure the quotes are at the beginning and end of the line, otherwiser you enginemanager will not start. If you copy the line and replace it, you should be fine. <\/p>\n
sudo vi \/usr\/local\/WowzaStreamingEngine\/manager\/bin\/startmgr.sh\r\n:set number\r\n\r\n# Change this \r\nCMD=\"$_EXECJAVA -cp $CLASSPATH $JAVA_SYSTEM_PROPERTIES launch.Main --prefix=\/enginemanager --defaultWebApp=\/enginemanager --tempDirectory=$WMSMGR_HOME\/temp --webroot=$WMSMGR_HOME\/temp --warfile=$WMSMGR_HOME\/lib\/WMSManager.war --httpPort=8088 --config=$WMSMGR_HOME\/conf\/tomcat.properties --ajp13Port=-1 --directoryListings=false\"\r\n\r\n#with this:\r\nCMD=\"$_EXECJAVA -cp $CLASSPATH $JAVA_SYSTEM_PROPERTIES launch.Main --prefix=\/enginemanager --defaultWebApp=\/enginemanager --tempDirectory=$WMSMGR_HOME\/temp --webroot=$WMSMGR_HOME\/temp --warfile=$WMSMGR_HOME\/lib\/WMSManager.war --httport=-1 --httpsPort=8090 --httpsKeyStore=\"\/usr\/local\/WowzaStreamingEngine\/conf\/wowza.vanmarion.nl.jks\" --httpsKeyStorePassword=\"secret\" --config=$WMSMGR_HOME\/conf\/tomcat.properties --ajp13Port=-1 --directoryListings=false\"<\/pre>\nExample:<\/p>\n
![\"\"](\"https:\/\/vanmarion.nl\/blog\/wp-content\/uploads\/2023\/06\/startmgr-changeCMD-300x46.jpg\")
<\/a><\/p>\n <\/p>\n
<\/p>\n
Configuration is now done for SSL. <\/p>\n
Step 7 – Restart wozwa services. <\/strong><\/p>\nsudo service WowzaStreamingEngineManager restart\r\nsudo service WowzaStreamingEngine restart<\/pre>\nNow open a browser and login on the Enginemanager over SSL<\/p>\n
https:\/\/wowza.vanmarion.nl:8090\/enginemanager<\/p>\n
Your playback stream for example will be like https:\/\/wowza.vanmarion.nl:443\/live\/streamkey\/playlist.m3u8<\/p>\n
Step 8 – Firewall ports<\/h3>\n
Port 8088 is no longer needed and you can delete this from the CSF config if you want. Feel free to do that. Open the firewall config by editing the file \/etc\/csf\/csf.conf<\/p>\n
and change line 139 and remove port 8088. <\/p>\n
TCP_IN = \"22,53,80,443,554,1935,8084:8088,8090\"\r\n\r\nto\r\nTCP_IN = \"22,53,80,443,554,1935,8090\"<\/pre>\nMore information about the ports can be found here: Github nlmaca<\/a><\/p>\nThen restart CSF by the following commands<\/p>\n
# disable CSF\r\ncsf -x\r\n\r\n# enable CSF\r\ncsf -e\r\n\r\n# restart CSF\r\ncsf -r<\/pre>\n <\/p>\n
In the next tutorial i will explain how to use VideoJS as a free webplayer. <\/p>\n
Questions: <\/h3>\n
If you have any questions or have issues please be specific in which step you run into problems. <\/p>\n
Tutorial series<\/h3>\n
In case you used the installer from part 1<\/a> or part 1.1<\/a> of the turorial series, SSL is already pre-configured in the Firewall. <\/p>\n In the next steps i will create the SSL on wowza.vanmarion.nl. Make sure you change this url to your setup. <\/p>\n just follow these commands and run as sudo<\/p>\n We now will request an SSL certificate for our domainname.<\/p>\n Set an emailadress where letsencrypt can send mails to and let you know if the certificate needs renewal. <\/p>\n Answer the next questions with yes and no<\/p>\n The certificate now gets created. You should see something like this:<\/p>\n Well done. You have succesfully created the Letsencrypt certificate. Now we will convert the certificate to a JKS format which we need in the next steps<\/p>\n Follow the next series of commands <\/p>\n Now when read the created jks txt file we see this:<\/p>\n Copy this line in a notepad or editor of your choice. We will need this information in the next steps. <\/p>\n We will enable 443 Module by removing the <!– and –> tags around the <HostPort> tag<\/p>\n See the image below for the desired setup. <\/p>\n 1 and 2: Remove the <!– and –> tags<\/p>\n 3 and 4. Only Change only the keyStorePath and keyStorePassword to the ones from the jks file (see step 3). The rest doesn’t have to be changed<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n Original: <\/p>\n to: <\/p>\n ** make sure to change wowza.vanmarion.nl to your domainname<\/p>\n Note: if you want to see line numbers when you have opened your file just hit <\/p>\n Now save the file.<\/p>\n In order to run the Enginemanager on port 8090 change this file and uncomment the first 3 lines<\/p>\n Result:<\/p>\n The second step is a bit more tricky. We will disable the http port and only allow https port 8090. Open the file startmgr.sh<\/p>\n We will change the second CMD command. Make sure the quotes are at the beginning and end of the line, otherwiser you enginemanager will not start. If you copy the line and replace it, you should be fine. <\/p>\n Example:<\/p>\n <\/p>\n <\/p>\n Configuration is now done for SSL. <\/p>\n Step 7 – Restart wozwa services. <\/strong><\/p>\n Now open a browser and login on the Enginemanager over SSL<\/p>\n https:\/\/wowza.vanmarion.nl:8090\/enginemanager<\/p>\n Your playback stream for example will be like https:\/\/wowza.vanmarion.nl:443\/live\/streamkey\/playlist.m3u8<\/p>\n Port 8088 is no longer needed and you can delete this from the CSF config if you want. Feel free to do that. Open the firewall config by editing the file \/etc\/csf\/csf.conf<\/p>\n and change line 139 and remove port 8088. <\/p>\n More information about the ports can be found here: Github nlmaca<\/a><\/p>\n Then restart CSF by the following commands<\/p>\n <\/p>\n In the next tutorial i will explain how to use VideoJS as a free webplayer. <\/p>\n If you have any questions or have issues please be specific in which step you run into problems. <\/p>\nImportant<\/h3>\n
Step 1 – install Snap and certbot<\/h3>\n
# install snap\r\nsudo apt install snapd -y\r\nsudo systemctl enable --now snapd.socket\r\nsudo ln -s \/var\/lib\/snapd\/snap \/snap\r\n\r\n# remove certbot-auto and Certbot packages\r\nsudo apt remove certbot\r\n\r\n# install certbot\r\nsudo snap install --classic certbot\r\n\r\n# cereate a symlink\r\nsudo ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/pre>\n
Step 2 – request the SSL certificate<\/h3>\n
sudo certbot certonly --standalone -d wowza.vanmarion.nl --key-type rsa<\/pre>\n
#Saving debug log to \/var\/log\/letsencrypt\/letsencrypt.log\r\n#Enter email address (used for urgent renewal and security notices)\r\n# (Enter 'c' to cancel): <set-email-address>\r\n<\/pre>\n
#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#Please read the Terms of Service at\r\n#https:\/\/letsencrypt.org\/documents\/LE-SA-v1.3-September-21-2022.pdf. You must\r\n#agree in order to register with the ACME server. Do you agree?\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#(Y)es\/(N)o: y\r\n\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#Would you be willing, once your first certificate is successfully issued, to\r\n#share your email address with the Electronic Frontier Foundation, a founding\r\n#partner of the Let's Encrypt project and the non-profit organization that\r\n#develops Certbot? We'd like to send you email about our work encrypting the web,\r\n#EFF news, campaigns, and ways to support digital freedom.\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#(Y)es\/(N)o: n\r\n\r\n<\/pre>\n
#Account registered.\r\n#Requesting a certificate for wowza.vanmarion.nl\r\n\r\n#Successfully received certificate.\r\n#Certificate is saved at: \/etc\/letsencrypt\/live\/wowza.vanmarion.nl\/fullchain.pem\r\n#Key is saved at: \/etc\/letsencrypt\/live\/wowza.vanmarion.nl\/privkey.pem\r\n#This certificate expires on 2023-09-17.\r\n#These files will be updated when the certificate renews.\r\n#Certbot has set up a scheduled task to automatically renew this certificate in the background.\r\n\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n#If you like Certbot, please consider supporting our work by:\r\n# * Donating to ISRG \/ Let's Encrypt: https:\/\/letsencrypt.org\/donate\r\n# * Donating to EFF: https:\/\/eff.org\/donate-le\r\n#- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n<\/pre>\n
Step 3 – Letsencrypt converter<\/h3>\n
#- Convert the SSL certificate so we can use it in Wowza. Letsencrypt converter (creation JKS file). \r\n#- Credits to Robymus: https:\/\/github.com\/robymus\r\n\r\ncd \/usr\/local\/WowzaStreamingEngine\/lib \r\nsudo wget https:\/\/github.com\/robymus\/wowza-letsencrypt-converter\/releases\/download\/v0.2\/wowza-letsencrypt-converter-0.2.jar\r\nsudo java -jar wowza-letsencrypt-converter-0.2.jar -v \/usr\/local\/WowzaStreamingEngine\/conf\/ \/etc\/letsencrypt\/live\/\r\n\r\n# 2 files should have been created. a .jks and a .txt file. Read the txt file and copy the contents in a temporary notepad\r\n<\/pre>\n
cat \/usr\/local\/WowzaStreamingEngine\/conf\/jksmap.txt\r\n\r\n#example output: \r\nSUB.DOMAIN.EXT={\"keyStorePath\":\"\/usr\/local\/WowzaStreamingEngine\/conf\/wowza.vanmarion.nl.jks\", \"keyStorePassword\":\"secret\", \"keyStoreType\":\"JKS\"}<\/pre>\nStep 4 – Enable SSL module in VHost.xml<\/h3>\n
sudo vi \/usr\/local\/WowzaStreamingEngine\/conf\/VHost.xml<\/pre>\n
<\/a><\/p>\n<SSLConfig>\r\n <KeyStorePath>${com.wowza.wms.context.VHostConfigHome}\/conf\/keystore.jks<\/KeyStorePath>\r\n <KeyStorePassword>[password]<\/KeyStorePassword>\r\n <KeyStoreType>JKS<\/KeyStoreType>\r\n <DomainToKeyStoreMapPath><\/DomainToKeyStoreMapPath>\r\n <SSLProtocol>TLS<\/SSLProtocol>\r\n <Algorithm>SunX509<\/Algorithm>\r\n <CipherSuites><\/CipherSuites>\r\n <Protocols><\/Protocols>\r\n<\/SSLConfig><\/pre>\n<SSLConfig>\r\n <KeyStorePath>${com.wowza.wms.context.VHostConfigHome}\/conf\/wowza.vanmarion.nl.jks<\/KeyStorePath>\r\n <KeyStorePassword>secret<\/KeyStorePassword>\r\n <KeyStoreType>JKS<\/KeyStoreType>\r\n <DomainToKeyStoreMapPath><\/DomainToKeyStoreMapPath>\r\n <SSLProtocol>TLS<\/SSLProtocol>\r\n <Algorithm>SunX509<\/Algorithm>\r\n <CipherSuites><\/CipherSuites>\r\n <Protocols><\/Protocols>\r\n <AllowHttp2>false<\/AllowHttp2>\r\n<\/SSLConfig><\/pre>\n:set number<\/pre>\n
Step 5 – Edit tomcat properties<\/h3>\n
sudo vi \/usr\/local\/WowzaStreamingEngine\/manager\/conf\/tomcat.properties<\/pre>\n
httpsPort=8090\r\nhttpsKeyStore=\/usr\/local\/WowzaStreamingEngine\/conf\/wowza.vanmarion.nl.jks\r\nhttpsKeyStorePassword=secret\r\n#httpsKeyAlias=[key-alias]<\/pre>\n
Step 6 – Edit startmgr<\/h3>\n
sudo vi \/usr\/local\/WowzaStreamingEngine\/manager\/bin\/startmgr.sh\r\n:set number\r\n\r\n# Change this \r\nCMD=\"$_EXECJAVA -cp $CLASSPATH $JAVA_SYSTEM_PROPERTIES launch.Main --prefix=\/enginemanager --defaultWebApp=\/enginemanager --tempDirectory=$WMSMGR_HOME\/temp --webroot=$WMSMGR_HOME\/temp --warfile=$WMSMGR_HOME\/lib\/WMSManager.war --httpPort=8088 --config=$WMSMGR_HOME\/conf\/tomcat.properties --ajp13Port=-1 --directoryListings=false\"\r\n\r\n#with this:\r\nCMD=\"$_EXECJAVA -cp $CLASSPATH $JAVA_SYSTEM_PROPERTIES launch.Main --prefix=\/enginemanager --defaultWebApp=\/enginemanager --tempDirectory=$WMSMGR_HOME\/temp --webroot=$WMSMGR_HOME\/temp --warfile=$WMSMGR_HOME\/lib\/WMSManager.war --httport=-1 --httpsPort=8090 --httpsKeyStore=\"\/usr\/local\/WowzaStreamingEngine\/conf\/wowza.vanmarion.nl.jks\" --httpsKeyStorePassword=\"secret\" --config=$WMSMGR_HOME\/conf\/tomcat.properties --ajp13Port=-1 --directoryListings=false\"<\/pre>\n
<\/a><\/p>\nsudo service WowzaStreamingEngineManager restart\r\nsudo service WowzaStreamingEngine restart<\/pre>\n
Step 8 – Firewall ports<\/h3>\n
TCP_IN = \"22,53,80,443,554,1935,8084:8088,8090\"\r\n\r\nto\r\nTCP_IN = \"22,53,80,443,554,1935,8090\"<\/pre>\n
# disable CSF\r\ncsf -x\r\n\r\n# enable CSF\r\ncsf -e\r\n\r\n# restart CSF\r\ncsf -r<\/pre>\n
Questions: <\/h3>\n
Tutorial series<\/h3>\n