Wowza restart needed ...?

[ChR-iSz]

Hello,

is a wowza restart needed after renew certs ?
I have actually the problem, that i must restart wowza every time i update the certificates...

[cowanmax]

Yes, you need. You can use sh script in crontab.

[ChR-iSz]

Thanks for answere.

Yes, i know, but this interrupt my recordings every time...

[robymus]

Oh, is a restart needed now? I haven't kept an eye on this for a while, things might have changed, but at Wowza 4.5.0 restart was not needed, when using the keymap file in the configs, only when referencing the jks files directly. That's why I created this project in the first place, I was so glad for this loophole, to update certificate without restarting.

[ChR-iSz]

Keymap in configs?

Do you habe a code snipped from the config part? Then i can test with the latest wowza version...

[robymus]

See fragment for ssl configuration in VHost.xml with keymaps (note: this might be slightly outdated). This is Wowza's way to support multiple domains with ssl, and as a side effect it supports dymanic reloading of certs/keys when the jksmap file changes.

				<SSLConfig>
					<DomainToKeyStoreMapPath>/path/jksmap.txt</DomainToKeyStoreMapPath>
					<SSLProtocol>TLS</SSLProtocol>
					<Algorithm>SunX509</Algorithm>
					<CipherSuites></CipherSuites>
					<Protocols></Protocols>
					<AllowHttp2>false</AllowHttp2>
				</SSLConfig>

[ChR-iSz]

Mhh,

i see you use the DomainToKeyStoreMapPath instead KeyStorePath and KeyStorePassword.
It would be great if we could get rid of the wowza restart as it really sucks to have to restart wowza every 2 months....

Can you please show us briefly how your /path/jksmap.txt is constructed? And what is with the params:
KeyStorePassword, KeyStoreType? I don't see that in your config part...

<SSLConfig>
        <KeyStorePath>${com.wowza.wms.context.VHostConfigHome}/conf/domain.jks</KeyStorePath>
        <KeyStorePassword>SecretPasswordHere</KeyStorePassword>
        <KeyStoreType>JKS</KeyStoreType>
        <DomainToKeyStoreMapPath></DomainToKeyStoreMapPath>
        <SSLProtocol>TLS</SSLProtocol>
        <Algorithm>SunX509</Algorithm>
        <CipherSuites></CipherSuites>
        <AllowHttp2>false</AllowHttp2>
</SSLConfig>

Do you have a little HowTo ?

[ChR-iSz]

Edit: I found a tutorial here:

https://www.wowza.com/docs/how-to-configure-multiple-ssl-certificates-per-domain-on-a-single-host-port-sni

Okay, then last step, can you tell us, how you refresh the certificate, WITHOUT Wowza restart ?

[robymus]

What I do is just run the converter as the renew hook on certificate refresh. The converter rewrites the jksmap file, Wowza detects the file modification change and reloads it automatically, and the certificates as well.

…

On Fri, Mar 3, 2023, 17:53 ChR-iSz ***@***.***> wrote: Edit: I found a tutorial here: https://www.wowza.com/docs/how-to-configure-multiple-ssl-certificates-per-domain-on-a-single-host-port-sni Okay, then last step, can you tell us, how you refresh the certificate, WITHOUT Wowza restart ? — Reply to this email directly, view it on GitHub <#7 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFBAW5AQYLWUFMZ7YHKNDDW2GINVANCNFSM6AAAAAAT7DMV7Y> . You are receiving this because you commented.Message ID: ***@***.***>

[ChR-iSz]

Thanks,

I have now changed to DomainToKeyStoreMapPath instead KeyStorePath, but I don't think this should solve my problem.

Just for understanding. Even with an expired certificate, Wowza continues to record and is operable. However, I can no longer output streams via HLS.

I'm curious to see if it works now. To test it, I would just have to expire my current certificate... Let's see how I can do that...

[ChR-iSz]

Mhh,same issue with your SSLCOnfig. Today i got again the same issue with expired certificate.

[ChR-iSz]

Can you show us please your cron, to renew your cert. Looks like my issue is on the renew-hook.
If i call

/usr/local/WowzaStreamingEngine/java/bin/java -jar /usr/local/WowzaStreamingEngine/lib/wowza-letsencrypt-converter-0.1.jar -v /usr/local/WowzaStreamingEngine/conf/ /etc/letsencrypt/live/manually, i don't need a wowza restart.

Here is my cron.d/certbot:
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew --renew-hook '/usr/local/WowzaStreamingEngine/java/bin/java -jar /usr/local/WowzaStreamingEngine/lib/wowza-letsencrypt-converter-0.1.jar -v /usr/local/WowzaStreamingEngine/conf/ /etc/letsencrypt/live/'