{"id":78,"date":"2025-08-27T00:00:00","date_gmt":"2025-08-26T15:00:00","guid":{"rendered":"https:\/\/www.eqmaker.kr\/en\/?p=78"},"modified":"2026-08-18T23:56:29","modified_gmt":"2026-08-18T14:56:29","slug":"wowza-self-signed-certificate","status":"publish","type":"post","link":"https:\/\/www.eqmaker.kr\/en\/wowza-self-signed-certificate\/","title":{"rendered":"How to Create a Self-Signed HTTPS Certificate and Apply It to Wowza"},"content":{"rendered":"\n

To send an HTTPS<\/abbr> HLS<\/abbr> stream, the streaming program must trust the server’s self-signed certificate. This article explains how to create a certificate and private key with Python and how to register the certificate in the Java cacerts used by Wowza Streaming Engine.<\/p>\n\n

\n

HTTPS Certificates and HLS<\/h2>\n

HLS<\/dfn> is a streaming method that uses HTTP<\/abbr>, which is widely used for web services, to send video data and playlists<\/a>.<\/p>\n

Several security problems arose with HTTP, which has been used since the early days of the Internet. HTTPS<\/dfn> became widely used to address these problems. It is now the standard method for modern Internet transmission. HTTPS encrypts transmitted data with a key<\/strong>. It uses a certificate<\/strong> to verify the identity of the other party. This improves the reliability of the communication.<\/p>\n

These security measures are very helpful in a real service environment, but not in a development environment<\/a>. A certificate in a test environment is not officially registered. This causes problems in the verification process and makes integration fail.<\/p>\n

Therefore, in a test environment where a publicly trusted certificate cannot be used, you must create a self-signed certificate and private key<\/strong> and apply them to the test server. You must also separately register the certificate so that the connecting program trusts it.<\/p>\n

This article explains how to use Python to create a self-signed certificate and private key for a private HLS PUSH server such as PushCap<\/code>. It also explains how to register the certificate in the Java trust store used by Wowza Streaming Engine (hereafter called WSE), and send an HTTPS HLS PUSH stream.<\/p>\n<\/section>\n\n

\n

How to Create a Certificate with Python<\/h2>\n
\n

Prepare the Python Environment<\/h3>\n
    \n
  1. Install Python<\/strong>\n

    This example uses Python. Therefore, Python must be installed on the PC where you will create the key and certificate.<\/p>\n <\/li>\n

  2. Install the additional package<\/strong>\n

    Use the following command to install the cryptography<\/code> package required to run the program.<\/p>\n py -m pip install cryptography<\/code>\n <\/li>\n <\/ol>\n <\/section>\n

    \n

    Create the Program File<\/h3>\n

    Create a suitable directory. Copy the code below and save it as GenCert.py<\/code>.<\/p>\n

    from cryptography import x509\nfrom cryptography.x509.oid import NameOID\nfrom cryptography.hazmat.primitives import hashes\nfrom cryptography.hazmat.primitives.asymmetric import rsa\nfrom cryptography.hazmat.primitives import serialization\nimport datetime\n\n# Enter the domain name here. This is the address entered in the streaming program.\ndomain_name = u\"b.upload.youtube.com\"\n\n# 1. Create a private key\nkey = rsa.generate_private_key(\n    public_exponent=65537,\n    key_size=2048,\n)\n\n# 2. Save the private key to a file (key.pem)\nwith open(\"key.pem\", \"wb\") as f:\n    f.write(key.private_bytes(\n        encoding=serialization.Encoding.PEM,\n        format=serialization.PrivateFormat.TraditionalOpenSSL,\n        encryption_algorithm=serialization.NoEncryption(),\n    ))\n\n# 3. Set the certificate information for self-signing (change the Common Name)\nsubject = issuer = x509.Name([\n    x509.NameAttribute(NameOID.COUNTRY_NAME, u\"KR\"),\n    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u\"Jeju-do\"),\n    x509.NameAttribute(NameOID.LOCALITY_NAME, u\"Mola-si\"),\n    x509.NameAttribute(NameOID.ORGANIZATION_NAME, u\"EQMaker\"),\n    x509.NameAttribute(NameOID.COMMON_NAME, domain_name),\n])\n\n# 4. Create and sign the certificate\ncert = x509.CertificateBuilder().subject_name(\n    subject\n).issuer_name(\n    issuer\n).public_key(\n    key.public_key()\n).serial_number(\n    x509.random_serial_number()\n).not_valid_before(\n    datetime.datetime.now(datetime.timezone.utc)\n).not_valid_after(\n    datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=365)\n).add_extension(\n    x509.SubjectAlternativeName([x509.DNSName(domain_name)]),\n    critical=False,\n).sign(key, hashes.SHA256())\n\n# 5. Save the certificate to a file (cert.pem)\nwith open(\"cert.pem\", \"wb\") as f:\n    f.write(cert.public_bytes(serialization.Encoding.PEM))\n\nprint(f\"'{domain_name}'  cert.pem \/ key.pem created.\")\n<\/code><\/pre>\n            
    Replace b.upload.youtube.com<\/samp> with the host name of the HTTPS URL<\/abbr> you want to use. In other words, the server with this certificate claims that it is b.upload.youtube.com<\/code>.<\/p>\n    <\/section>\n\n    
    \n        
    Create the Certificate<\/h3>\n            
    In a console window, move to the directory that contains GenCert.py<\/code>. Run the code. If the message created<\/samp> appears as shown below, the cryptographic key and certificate were created successfully.<\/p>\n
    Microsoft Windows [Version 10.0.20348.4052]\n(c) Microsoft Corporation. All rights reserved.\nD:\\>cd HLSWEB<\/kbd>\nD:\\HLSWEB>py GenCert.py<\/kbd>\n'b.upload.youtube.com' cert.pem \/ key.pem created.<\/samp><\/pre>\n        
    Copy the generated cert.pem<\/code> and key.pem<\/code> files to the directory where PushCap.py<\/code> runs. If you another type of receiving server, register the certificate and key files on that server.<\/p>\n    <\/section>\n    
    If you use a streaming program such as OBS<\/abbr> that does not have a separate certificate and key verification function, you can send an HTTPS HLS stream without additional work. However, WSE verifies whether the server certificate is trusted. Because the certificate is not publicly trusted, the additional registration procedure below is required.<\/p>\n<\/section>\n\n
    \n    
    Apply a Private Certificate to Wowza Streaming Engine<\/h2>\n    
    Commercial streaming programs such as WSE may perform their own additional certificate verification. A self-signed certificate is not registered in the default trust store. Therefore, you must directly register the certificate presented by the PushCap server in WSE’s Java trust store.<\/p>\n    
    \n    
    Procedure for Applying a Private Certificate to Wowza Streaming Engine<\/h3>\n    
      \n        
    1. Stop the WSE service<\/strong><\/li>\n        
    2. Open a console<\/strong>: Open a console, such as a DOS window, with administrator privileges.<\/li>\n        
    3. Move to the Java tool directory<\/strong>\n            
      Move to the Java tool directory installed with WSE. The default path is [WSE default installation path]\/jre\/bin<\/code>. The default path may differ if you use a separately installed Java version or a different WSE version. Check the path carefully.<\/p>\n        <\/li>\n        
    4. \n            Register the certificate file<\/strong>\n            
      The bin<\/code> directory contains an executable file named keytool<\/code>. Enter the following command to register the certificate file.<\/p>\n            keytool -importcert -alias \"[certificate name]\" -keystore \"[certificate store]\" -storepass changeit -file \"[certificate file]\"<\/code>\n            
      \n                
      [certificate name]<\/dt>\n                
      The name of the certificate to use in WSE. You may choose any name.<\/dd>\n                
      [certificate store]<\/dt>\n                
      The location where the certificate will be stored. It is the certificate store inside the JRE<\/abbr> directory used by WSE. The default path is [WSE installation path]\\jre\\lib\\security\\cacerts<\/code>.<\/dd>\n                
      [certificate file]<\/dt>\n                
      The path and file name of the certificate file (.pem<\/code>) to register<\/dd>\n            <\/dl>\n            
      changeit<\/code> is the initial password of the Java cacerts<\/code> trust store. If the administrator changed the password, enter the actual password instead.<\/p>\n        <\/li>\n    <\/ol>\n    <\/section>\n\n    
      \n    
      Example of Applying and Verifying a Certificate in Wowza Streaming Engine<\/h3>\n    
      The following is an actual example of applying a private certificate to WSE on Windows. The environment is as follows.<\/p>\n    
      \n        
      Operating system<\/dt>\n        
      Windows Server 2022<\/dd>\n        
      WSE version<\/dt>\n        
      4.8.25+2<\/dd>\n        
      Certificate file path<\/dt>\n        
      D:\\HLSWEB\\cert.pem<\/code><\/dd>\n    <\/dl>\n\n    
        \n        
      1. Open a console window, such as a DOS window, with administrator privileges.<\/li>\n        
      2. \n            Stop the WSE service<\/strong>\n
        C:\\>sc stop WowzaStreamingEngine4825+2<\/kbd>\n\nSERVICE_NAME: WowzaStreamingEngine4825+2\n        TYPE               : 10  WIN32_OWN_PROCESS\n        STATE              : 3  STOP_PENDING\n                                (STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN)\n        WIN32_EXIT_CODE    : 0  (0x0)\n        SERVICE_EXIT_CODE  : 0  (0x0)\n        CHECKPOINT         : 0x0\n        WAIT_HINT          : 0x7d0<\/samp><\/pre>\n        <\/li>\n\n        
      3. Register the certificate<\/strong>\n
        C:\\>Program Files\\Wowza Media Systems\\Wowza Streaming Engine 4.8.25+2\\jre\\bin>keytool.exe -importcert -alias \"YouTubeLocal\" -keystore \"C:\\Program Files\\Wowza Media Systems\\Wowza Streaming Engine 4.8.25+2\\jre\\lib\\security\\cacerts\" -storepass changeit -file \"D:\\HLSWEB\\cert.pem\"<\/kbd>\nWarning: use -cacerts option to access cacerts keystore\nOwner: CN=b.upload.youtube.com, O=EQMaker, L=Mola-si, ST=Jeju-do, C=KR\nIssuer: CN=b.upload.youtube.com, O=EQMaker, L=Mola-si, ST=Jeju-do, C=KR\nSerial number: 389c81b7d9e5452c8cbace6436a99aff004376\nValid from: Mon Aug 25 23:34:59 KST 2025 until: Tue Aug 25 23:34:59 KST 2026\nCertificate fingerprints:\n         SHA1: AA:BB:CC:DD:EE:00:AA:BB:CC:DD:EE:00:65:33:A0:A8:44:55:C0:54\n         SHA256: AA:BB:CC:DD:EE:00:AA:BB:CC:DD:EE:FF:00:AA:BB:CC:DD:EE:25:9E:AD:00:54:DE:D0:AE:52:97:1C:A1:85:59\nSignature algorithm name: SHA256withRSA\nSubject Public Key Algorithm: 2048-bit RSA key\nVersion: 3\n\nExtensions:\n\n#1: ObjectId: 2.5.29.17 Criticality=false\nSubjectAlternativeName [\n  DNSName: b.upload.youtube.com\n]\n\nTrust this certificate? [no]:  yes<\/kbd>\nCertificate was added to keystore<\/samp><\/pre>\n        <\/li>\n\n        
      4. Verify the certificate registration<\/strong>\n
        C:\\Program Files\\Wowza Media Systems\\Wowza Streaming Engine 4.8.25+2\\jre\\bin>keytool -list -cacerts<\/kbd>\nEnter keystore password:Enter<\/kbd>\n\n*****************  WARNING WARNING WARNING  *****************\n* The integrity of the information stored in your keystore  *\n* has NOT been verified!  In order to verify its integrity, *\n* you must provide your keystore password.                  *\n*****************  WARNING WARNING WARNING  *****************\n\nKeystore type: JKS\nKeystore provider: SUN\n\nYour keystore contains 93 entries\n\n... (earlier lines omitted) ...\nyoutubelocal, 2025 Aug 26, trustedCertEntry,\nCertificate fingerprint (SHA-256): AA:BB:CC:DD:EE:00:AA:BB:CC:DD:EE:FF:00:AA:BB:CC:DD:EE:25:9E:AD:00:54:DE:D0:AE:52:97:1C:A1:85:59\n... (omitted) ...<\/samp><\/pre>\n            
        If a certificate with the registered name, youtubelocal<\/samp> in this example, exists as shown above, it was registered successfully.<\/p>\n        <\/li>\n        
      5. Restart the WSE service<\/strong>\n
        C:\\>sc start WowzaStreamingEngine4825+2<\/kbd>\nSERVICE_NAME: WowzaStreamingEngine4825+2\n        TYPE               : 10  WIN32_OWN_PROCESS\n        STATE              : 2  START_PENDING\n                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)\n        WIN32_EXIT_CODE    : 0  (0x0)\n        SERVICE_EXIT_CODE  : 0  (0x0)\n        CHECKPOINT         : 0x0\n        WAIT_HINT          : 0x7d0\n        PID                : 4356\n        FLAGS              :<\/samp><\/pre>\n        <\/li>\n    <\/ol>\n<\/section>\n<\/section>\n\n
        \n    
        FAQ<\/h2>\n    
        \n        
        Why is a certificate needed for HLS transmission?<\/dt>\n        
        \n            
        HLS itself does not always require a certificate. However, a transmission that uses HTTPS, such as YouTube HLS PUSH, needs a certificate to verify the server’s identity and encrypt the data. A certificate is not needed if only HTTP is used, but the communication is not encrypted.<\/p>\n        <\/dd>\n\n        
        What is the difference between a private certificate and a publicly trusted certificate?<\/dt>\n        
        \n            
        A publicly trusted certificate is issued by a public certificate authority that operating systems and programs trust by default. A private certificate is self-signed or issued by an internal certificate authority. Therefore, it must be separately registered as trusted in the connecting program. The main difference between the two certificates is their default trust status, not their encryption function.<\/p>\n        <\/dd>\n\n        
        What is the difference between a key and a certificate?<\/dt>\n        
        \n            
        A private key is secret information that a server uses to prove ownership and set up TLS communication. It must not be made public. A certificate contains information such as the server name, public key, issuer, and validity period. It is presented to the connecting program. The certificate and private key must be a matching pair.<\/p>\n        <\/dd>\n\n        
        Can HTTPS transmission work with only a key and no certificate?<\/dt>\n        
        \n            
        This is not possible in normal HTTPS communication. The server must use a certificate and its matching private key together. With only a private key, the client cannot verify the identity of the server. Therefore, it cannot operate as a normal HTTPS server.<\/p>\n        <\/dd>\n\n        
        Can a certificate be issued for an IP address instead of a domain address?<\/dt>\n        
        \n            
        Yes. A certificate for an IP address must record the IP address in the SAN instead of a domain name. In the Python cryptography<\/code> package, use x509.IPAddress()<\/code> instead of x509.DNSName()<\/code>. However, it is difficult to issue a publicly trusted certificate for a private IP address, and the address may change. Therefore, it is mainly used in a fixed test environment or an internal system.<\/p>\n        <\/dd>\n\n        
        Does Wowza Streaming Engine have certificates for every platform?<\/dt>\n        
        \n            
        No. The Java trust store used by WSE does not contain the certificates of every server. It contains the root and intermediate certificates of major trusted certificate authorities. WSE checks whether the certificate presented by the server can be verified through this trust system. A self-signed certificate must be registered separately.<\/p>\n        <\/dd>\n\n        
        Why is only the certificate registered in Wowza, not the private key?<\/dt>\n        
        \n            
        The private key must be kept by PushCap<\/code>, the HTTPS receiving server. WSE is a client that connects to that server. It only needs to register the certificate presented by the server in its trust store. Do not register or send key.pem<\/code> to WSE’s cacerts<\/code>.<\/p>\n        <\/dd>\n\n        
        Does creating a certificate automatically send traffic for that domain to the test server?<\/dt>\n        
        \n            
        No. A certificate only identifies and verifies the server. It does not change the network route. To send requests for b.upload.youtube.com<\/code> to PushCap<\/code>, map the destination to the IP address of the test server. Do this in the hosts file of the streaming device, internal DNS, or a separate proxy.<\/p>\n        <\/dd>\n\n        
        Can the existing registration still be used if the certificate expires or is regenerated?<\/dt>\n        
        \n            
        No. A newly created certificate has a different public key and fingerprint from the existing certificate. Therefore, it must be registered again in WSE’s trust store. If the same alias already exists, delete the existing entry or use a different alias. Then restart the WSE service.<\/p>\n        <\/dd>\n\n        
        How can I check whether the certificate is correctly registered in Wowza?<\/dt>\n        
        \n            
        Use the keytool -list -cacerts<\/code> command in the JRE used by WSE. Check the alias and fingerprint of the registered certificate. To verify the integrity of the store, do not simply press Enter at the password prompt. Enter the actual cacerts<\/code> password. After registration, restart the WSE service to apply the change.<\/p>\n        <\/dd>\n    <\/dl>\n<\/section>\n\n
        \n
        Update History<\/h2>\n
          \n