How to Create a Self-Signed HTTPS Certificate and Apply It to Wowza

Prepare the Python Environment

1. Install Python

   This example uses Python. Therefore, Python must be installed on the PC where you will create the key and certificate.

2. Install the additional package

   Use the following command to install the cryptography package required to run the program.

   py -m pip install cryptography

Create the Program File

Create a suitable directory. Copy the code below and save it as GenCert.py.

from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization
import datetime

# Enter the domain name here. This is the address entered in the streaming program.
domain_name = u"b.upload.youtube.com"

# 1. Create a private key
key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
)

# 2. Save the private key to a file (key.pem)
with open("key.pem", "wb") as f:
    f.write(key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.TraditionalOpenSSL,
        encryption_algorithm=serialization.NoEncryption(),
    ))

# 3. Set the certificate information for self-signing (change the Common Name)
subject = issuer = x509.Name([
    x509.NameAttribute(NameOID.COUNTRY_NAME, u"KR"),
    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u"Jeju-do"),
    x509.NameAttribute(NameOID.LOCALITY_NAME, u"Mola-si"),
    x509.NameAttribute(NameOID.ORGANIZATION_NAME, u"EQMaker"),
    x509.NameAttribute(NameOID.COMMON_NAME, domain_name),
])

# 4. Create and sign the certificate
cert = x509.CertificateBuilder().subject_name(
    subject
).issuer_name(
    issuer
).public_key(
    key.public_key()
).serial_number(
    x509.random_serial_number()
).not_valid_before(
    datetime.datetime.now(datetime.timezone.utc)
).not_valid_after(
    datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=365)
).add_extension(
    x509.SubjectAlternativeName([x509.DNSName(domain_name)]),
    critical=False,
).sign(key, hashes.SHA256())

# 5. Save the certificate to a file (cert.pem)
with open("cert.pem", "wb") as f:
    f.write(cert.public_bytes(serialization.Encoding.PEM))

print(f"'{domain_name}'  cert.pem / key.pem created.")

Replace b.upload.youtube.com with the host name of the HTTPS URL you want to use. In other words, the server with this certificate claims that it is b.upload.youtube.com.

Create the Certificate

In a console window, move to the directory that contains GenCert.py. Run the code. If the message created appears as shown below, the cryptographic key and certificate were created successfully.

Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.
D:\>cd HLSWEB
D:\HLSWEB>py GenCert.py
'b.upload.youtube.com' cert.pem / key.pem created.

Copy the generated cert.pem and key.pem files to the directory where PushCap.py runs. If you another type of receiving server, register the certificate and key files on that server.

Procedure for Applying a Private Certificate to Wowza Streaming Engine

1. Stop the WSE service
2. Open a console: Open a console, such as a DOS window, with administrator privileges.
3. Move to the Java tool directory

   Move to the Java tool directory installed with WSE. The default path is [WSE default installation path]/jre/bin. The default path may differ if you use a separately installed Java version or a different WSE version. Check the path carefully.

4. Register the certificate file

   The bin directory contains an executable file named keytool. Enter the following command to register the certificate file.

   keytool -importcert -alias "[certificate name]" -keystore "[certificate store]" -storepass changeit -file "[certificate file]"

   [certificate name]

   The name of the certificate to use in WSE. You may choose any name.

   [certificate store]

   The location where the certificate will be stored. It is the certificate store inside the JRE directory used by WSE. The default path is [WSE installation path]\jre\lib\security\cacerts.

   [certificate file]

   The path and file name of the certificate file (.pem) to register

   changeit is the initial password of the Java cacerts trust store. If the administrator changed the password, enter the actual password instead.

Example of Applying and Verifying a Certificate in Wowza Streaming Engine

The following is an actual example of applying a private certificate to WSE on Windows. The environment is as follows.

Operating system

Windows Server 2022

WSE version

4.8.25+2

Certificate file path

D:\HLSWEB\cert.pem

1. Open a console window, such as a DOS window, with administrator privileges.
2. Stop the WSE service

   C:\>sc stop WowzaStreamingEngine4825+2
   
   SERVICE_NAME: WowzaStreamingEngine4825+2
           TYPE               : 10  WIN32_OWN_PROCESS
           STATE              : 3  STOP_PENDING
                                   (STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN)
           WIN32_EXIT_CODE    : 0  (0x0)
           SERVICE_EXIT_CODE  : 0  (0x0)
           CHECKPOINT         : 0x0
           WAIT_HINT          : 0x7d0

3. Register the certificate

   C:\>Program Files\Wowza Media Systems\Wowza Streaming Engine 4.8.25+2\jre\bin>keytool.exe -importcert -alias "YouTubeLocal" -keystore "C:\Program Files\Wowza Media Systems\Wowza Streaming Engine 4.8.25+2\jre\lib\security\cacerts" -storepass changeit -file "D:\HLSWEB\cert.pem"
   Warning: use -cacerts option to access cacerts keystore
   Owner: CN=b.upload.youtube.com, O=EQMaker, L=Mola-si, ST=Jeju-do, C=KR
   Issuer: CN=b.upload.youtube.com, O=EQMaker, L=Mola-si, ST=Jeju-do, C=KR
   Serial number: 389c81b7d9e5452c8cbace6436a99aff004376
   Valid from: Mon Aug 25 23:34:59 KST 2025 until: Tue Aug 25 23:34:59 KST 2026
   Certificate fingerprints:
            SHA1: AA:BB:CC:DD:EE:00:AA:BB:CC:DD:EE:00:65:33:A0:A8:44:55:C0:54
            SHA256: AA:BB:CC:DD:EE:00:AA:BB:CC:DD:EE:FF:00:AA:BB:CC:DD:EE:25:9E:AD:00:54:DE:D0:AE:52:97:1C:A1:85:59
   Signature algorithm name: SHA256withRSA
   Subject Public Key Algorithm: 2048-bit RSA key
   Version: 3
   
   Extensions:
   
   #1: ObjectId: 2.5.29.17 Criticality=false
   SubjectAlternativeName [
     DNSName: b.upload.youtube.com
   ]
   
   Trust this certificate? [no]:  yes
   Certificate was added to keystore

4. Verify the certificate registration

   C:\Program Files\Wowza Media Systems\Wowza Streaming Engine 4.8.25+2\jre\bin>keytool -list -cacerts
   Enter keystore password:Enter
   
   *****************  WARNING WARNING WARNING  *****************
   * The integrity of the information stored in your keystore  *
   * has NOT been verified!  In order to verify its integrity, *
   * you must provide your keystore password.                  *
   *****************  WARNING WARNING WARNING  *****************
   
   Keystore type: JKS
   Keystore provider: SUN
   
   Your keystore contains 93 entries
   
   ... (earlier lines omitted) ...
   youtubelocal, 2025 Aug 26, trustedCertEntry,
   Certificate fingerprint (SHA-256): AA:BB:CC:DD:EE:00:AA:BB:CC:DD:EE:FF:00:AA:BB:CC:DD:EE:25:9E:AD:00:54:DE:D0:AE:52:97:1C:A1:85:59
   ... (omitted) ...

   If a certificate with the registered name, youtubelocal in this example, exists as shown above, it was registered successfully.

5. Restart the WSE service

   C:\>sc start WowzaStreamingEngine4825+2
   SERVICE_NAME: WowzaStreamingEngine4825+2
           TYPE               : 10  WIN32_OWN_PROCESS
           STATE              : 2  START_PENDING
                                   (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
           WIN32_EXIT_CODE    : 0  (0x0)
           SERVICE_EXIT_CODE  : 0  (0x0)
           CHECKPOINT         : 0x0
           WAIT_HINT          : 0x7d0
           PID                : 4356
           FLAGS              :