Request an SSL certificate for Wowza Streaming Engine from a certificate authority

This article describes how to acquire and install a Secure Sockets Layer (SSL) certificate from a certificate authority such as verisign.com or thawte.com. This process requires the use of the command line tool keytool that comes with the Java JRE that installs with Wowza Streaming Engine™ media server software.

About SSL certificates

Certificates hold public keys. This article provides instructions for X509 certificates that are commonly received from a certificate authority. X509 defines formats for public key certificates. RSA and DSA are two of the public key algorithms that can be used in X509 certificates. X509 certificates commonly have a .cer, .crt, .der, or .pem extension.

Configure the Java JRE

The command line tool keytool is included in the Java JRE that installs with Wowza Streaming Engine. Be sure the bin folder of your JRE installation is added to your PATH environment variable. If the PATH variable is configured correctly, you should be able to open a command prompt and execute the keytool command. This should return the command reference for the keytool command. After you have the keytool command up and running, proceed to the following steps to create a certificate request.

Create a keystore and certificate signing request

1. Open a command prompt and change directory to [install-dir]/conf.
    
2. Execute the following command to create a keystore (.JKS) and a private key in the keystore:

   keytool -genkey -keysize 2048 -alias wowzaprivatekey -keyalg RSA -keystore ssl.mycompany.com.jks

   Notes:

   • The examples in this article assume the domain name associated with the certificate is ssl.mycompany.com. You can replace ssl.mycompany.com with the name of your certificate.
      
   • If you're using a wildcard certificate on Linux, we recommend using a wildcard character in the name of the certificate for clarity. When you're using a wildcard character, you must use quotation marks (") or a backwards slash (\) to escape the wildcard character in the commands. For example, the above command would be:
     
     keytool -genkey -keysize 2048 -alias wowzaprivatekey -keyalg RSA -keystore "*.ssl.mycompany.com.jks"
      
   • On Windows, wildcard characters, such as the asterisk (*), aren't supported in certificate names.
   You'll be prompted to answer several questions. The following sample responses assume that the domain name that you want this certificate to be tied to is ssl.mycompany.com. The password entered for the certificate should also be used for the keystore and CSR file.
    

   [Enter keystore password]
   password
   [What is your first and last name]
   ssl.mycompany.com
   [What is the name of your organizational unit]
   Web Department
   [What is the name of your organization]
   My Company Name
   [What is the name of your City or Locality]
   Evergreen
   [What is the name of your State or Province]
   Colorado
   [What is the two-letter country code for this unit]
   US
   [Enter key password for <password>]
   password

3. Create a CSR by executing the following command:

   keytool -certreq -file ssl.mycompany.com.csr -alias wowzaprivatekey -keyalg RSA -keystore ssl.mycompany.com.jks

Submit the certificate signing request to a certificate authority

After you have the [install-dir]/conf/ssl.mycompany.com.csr file that contains the PEM-encoded certificate request, you can submit it to the certificate authority. (Review the documentation on the certificate authority website about how to do this.) In most cases, you'll use a text editor to open the ssl.mycompany.com.csr file and copy-and-paste the contents into a web form for submission to the certificate authority. In return, you'll get a certificate.

Import the certificate to the keystore

1. Open a command prompt and change directory to [install-dir]/conf.
    
2. Execute the following command to determine the format of the certificate:

   openssl x509 -in ssl.mycompany.com-2016-07-13-111324.cer -text

   The output specifies the Public Key Algorithm, such as rsaEncryption, and the format, such as X509v3.
    
3. Execute one of the following commands to import the signed certificate that you received the from the certificate authority:
    
   • For a chain certificate:

     keytool -import -alias [user-friendly-name] -trustcacerts -file [filename-of-chain-certificate] -keystore ssl.mycompany.com.jks

     Where [user-friendly-name] is the user-friendly name for the certificate; we recommend using a name that describes the type of chain certificate, such as root, intermediate, or bundle. [filename-of-chain-certificate] is the file name of the chain certificate.
      
   • For a new certificate:

     keytool -import -alias wowzaprivatekey -trustcacerts -file [filename-certificate] -keystore ssl.mycompany.com.jks

     Where [filename-certificate] is the file name of the certificate in X509 format.

Configure a host port to use the certificate

1. Uncomment the <HostPort> definition for port 443. This entry follows the comment <!-- 443 with SSL -->. Be sure to remove the comment before <HostPort> and after </HostPort>.
    
2. Set the value SSLConfig/KeyStorePath to:

   ${com.wowza.wms.context.VHostConfigHome}/conf/ssl.mycompany.com.jks

3. Set the SSLConfig/KeyStorePassword to the key store password entered above.
    
4. Restart Wowza Streaming Engine.

Test the certificate and the Wowza Streaming Engine configuration

1. Use an editor such as vi to edit your etc/hosts file so that the domain name that the certificate is tied to points to the localhost IP address. For example, assuming the localhost IP address is 127.0.0.1, add the following lines to the etc/hosts file:

   #testing ssl
   127.0.0.1       ssl.mycompany.com
   # END ssl test

   Important: Be careful when editing the etc/hosts file. It is included on every computer and used by the operating system to map IP addresses to host names. Mistakes made when editing the hosts file can lead to a variety of problems, such as inaccessible network locations, network failures, or blocked websites.
2. Then check the [install-dir]/logs/wowzastreamingengine_access.log for the following statements indicating that it successfully bonded to port 443:

   SSL ([any]:443): keyStorePath:/Library/WowzaStreamingEngine/conf/ssl.mycompany.com.jks
   Bind successful ([any]:443)

More resources

• Troubleshoot SSL certificate configuration for Wowza Streaming Engine