This article provides an overview of how to use the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols with Wowza Streaming Engine™ media server software.
About SSL/TLS
SSL and TLS are security protocols for establishing secure network connections between two systems, for example, Wowza Streaming Engine and a video player.
The secure connection is established via what is commonly called the SSL/TLS handshake. During the handshake, information is exchanged between the server and client to confirm the authenticity of the server’s SSL/TLS certificate. If the server passes the test, an agreement is made regarding how the site content will be encrypted.
Note: The terms SSL and TLS are often used interchangeably. SSL was developed by Netscape in 1995. Due to security concerns, it received a much-needed makeover by the Internet Engineering Task Force (IETF) in 1999. The IETF standardized the protocol and changed the name from SSL to TLS.
Installing a TLS certificate
A TLS certificate is a file on the origin server of the site you're visiting. When you navigate to an HTTPS website, the certificate verifies that your browser is communicating with the server that owns the website domain. Each certificate contains information such as:
- The domain name for which the certificate was issued
- The person, organization, or device to whom it was issued
- The Certificate Authority that issued it
- The Certificate Authority’s digital signature
- Any associated subdomains
- The issue date of the certificate
- The expiration date of the certificate
- The public key
To install a TLS certificate on a WSE server, do one of the following:
- Request a Wowza StreamLock certificate – Wowza StreamLock™ service is a security option for network encryption that provides near-instant provisioning of free 2048-bit SSL/TLS certificates for use with Wowza Streaming Engine. For more information, see Get SSL/TLS certificates from the Wowza Streaming Engine StreamLock service.
Note: Wowza StreamLock certificates are available for WSE licenses with active maintenance and support, including trial licenses.
- Request a certificate from a third-party certificate authority – SSL/TLS certificates can also be obtained from a third-party certificate authority. To request a certificate, use the keytool utility that comes with the Java JRE that installs with Wowza Streaming Engine to create a keystore and certificate signing request. After you receive the certificate, import it into the keystore. For more information, see Request an SSL certificate for Wowza Streaming Engine from a certificate authority.
- Import an existing SSL/TLS certificate – If you already have an SSL/TLS certificate, you can use the keytool utility to import it into the keystore. For more information, see Import an existing SSL certificate and private key for Wowza Streaming Engine.
- Generate a self-signed certificate – Another option is to generate a self-signed SSL/TLS certificate using your own method and keys for encryption. For more information, see Create a self-signed SSL certificate for Wowza Streaming Engine.
Note: Self-signed certificates are considered untrustworthy by most browsers. We recommend using a signed certificate from Wowza or another trusted certificate authority.
SSL/TLS and Wowza Streaming Engine
WSE supports SSL and some versions of TLS for secure publish and playback of streams over HTTPS (HTTP over SSL/TLS), RTMPS (RTMP over SSL/TLS), encrypted RTMP (RTMPE), RTSPS (RTSP over SSL/TLS), WOWZS (WOWZ over SSL/TLS), and WSS (WebSocket Secure).
Note: SSL/TLS only protects streams during transit. For additional security, we recommend using SecureToken for playback protection. For more information, see Protect streaming using SecureToken in Wowza Streaming Engine.
SSL/TLS can also be configured for use with Wowza Streaming Engine as follows:
- Live stream repeaters – Enable RTMPS and WOWZS connections in a live stream repeater (origin/edge) configuration. For more information, see Configure a live stream repeater in Wowza Streaming Engine.
- Facebook Live – RTMPS is required when streaming to Facebook Live. For more information, see Stream to Facebook Live using Wowza Streaming Engine.
- JConsole – Use SSL/TLS to monitor Wowza Streaming Engine from a remote computer. For more information, see Use JConsole with Wowza Streaming Engine.
- Low-Latency HLS (LL-HLS) – SSL/TLS is required for LL-HLS playback. For more information, see Deliver Low-Latency HLS live streams using Wowza Streaming Engine.
- Media Cache – Enable HTTPS connections to Media Cache HTTP sources. For more information, see Scale video-on-demand streaming with Wowza Streaming Engine Media Cache.
- REST API – Use SSL/TLS to send HTTPS requests to the Wowza Streaming Engine REST API. For more information about the REST API, see Query the Wowza Streaming Engine REST API.
- WebRTC – SSL/TLS is required for WebRTC publishing and playback. For more information, see WebRTC workflows in Wowza Streaming Engine.
- Wowza Streaming Engine Manager – Enable HTTPS connections to Wowza Streaming Engine Manager (version 4.7.3 and later). For more information, see Connect to Wowza Streaming Engine Manager over HTTPS.
