SSL Certificate Setup for Your Streaming Server

Why SSL Matters for Streaming

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are no longer optional for streaming servers. Modern browsers require HTTPS for many features, including autoplay, fullscreen APIs, and service workers. Without SSL, your HLS streams may be blocked entirely on secure websites, and viewers will see browser warnings that erode trust.

Beyond browser requirements, SSL encrypts the connection between your server and viewers, preventing stream interception, URL theft, and man-in-the-middle attacks. For commercial IPTV operations, SSL is a baseline security requirement that protects both your content and your viewers' data.

HTTPS is also essential for embedding streams on third-party websites. If your stream URLs use HTTP while the host page uses HTTPS, browsers will block the stream as "mixed content" — a common issue that SSL eliminates entirely.

Let's Encrypt: Free Automatic SSL

Let's Encrypt is the recommended SSL option for most streaming servers. It provides free, trusted SSL certificates that are automatically issued and renewed. Here is how it works:

• Cost: Completely free — no fees, no subscriptions
• Renewal: Automatic renewal every 60 days (certificates are valid for 90 days, renewed at 60 to ensure overlap)
• Requirements: Your domain must point to your server's IP address via DNS, and port 80 must be accessible for the HTTP validation challenge
• Setup: Enter your domain name in the SSL settings panel and click "Issue Certificate" — the process is fully automated

Let's Encrypt uses the ACME protocol to validate that you control the domain before issuing the certificate. The validation requires an HTTP request to port 80 on your server, so ensure that no firewall rule or other service is blocking this port during the issuance process.

Custom SSL Certificates

If you already have an SSL certificate from a commercial certificate authority (such as DigiCert, Comodo, or GlobalSign), or if your organization requires a specific type of certificate (EV, wildcard, multi-domain), you can upload it directly.

To install a custom certificate, you need two files:

• Certificate file: The .crt or .pem file containing your certificate and any intermediate certificates (the full chain)
• Private key: The .key file that was generated when you created your Certificate Signing Request (CSR)

Upload both files through the SSL settings panel. The server will validate that the certificate and key match before activating HTTPS. Note that custom certificates require manual renewal — you must upload the new certificate before the current one expires.

Default Ports and Hostname Configuration

StreamDev uses the following default ports:

• Port 3000: HTTP — the web management interface and HLS stream delivery
• Port 1935: RTMP — for ingest from encoders like OBS, Wirecast, and vMix

When SSL is enabled, HTTPS is served on the same port (3000) with automatic HTTP-to-HTTPS redirection. Your hostname should be configured to match the domain on your SSL certificate. If you are using a subdomain (e.g., stream.yourdomain.com), ensure the DNS A record for that subdomain points to your server's IP address.

Secure Stream URL Format

Once SSL is configured, your HLS stream URLs change from HTTP to HTTPS:

https://your-domain.com/streams/stream_{id}/playlist.m3u8

This URL can be safely embedded on any HTTPS website, used in mobile apps, or shared with viewers without mixed content warnings. The RTMP ingest URL remains unchanged on port 1935, as RTMP has its own connection handling separate from HTTP/HTTPS.

Troubleshooting SSL Issues

If SSL setup fails or your HTTPS streams are not working, check these common issues:

Domain Not Pointing to Server

The most common Let's Encrypt failure. Verify your DNS A record points to your server's exact IP address. DNS changes can take up to 48 hours to propagate, though most resolve within minutes. Use a DNS lookup tool to confirm the record is correct before attempting certificate issuance.

Port 80 Blocked

Let's Encrypt requires port 80 to be accessible for the HTTP-01 challenge. Check your server's firewall rules, cloud provider security groups, and any upstream network devices that might block port 80. The port only needs to be open during certificate issuance and renewal.

Certificate Expired

If auto-renewal fails (usually due to port 80 becoming blocked after initial setup), your certificate will expire after 90 days. Viewers will see browser security warnings and streams will fail to load. To fix this, ensure port 80 is accessible and re-issue the certificate through the SSL settings panel.

Certificate and Key Mismatch

When uploading custom certificates, the private key must be the exact key that was used to generate the CSR for that certificate. If you receive a mismatch error, verify you are using the correct key file. Generating a new CSR and requesting a new certificate is sometimes easier than finding the original key.

Intermediate Certificates Missing

Some browsers require the full certificate chain (your certificate plus intermediate certificates) to validate trust. If viewers on certain browsers see SSL errors while others work fine, your certificate file likely needs the intermediate certificates appended. Your certificate authority provides these in their installation instructions.