# Article: How to secure Apple HTTP Live Streaming (AES-128 - external method) **URL:** \ **Category:** Wowza Streaming Engine\ **Tags:** media-players-and-devices\ **Created:** [October 1, 2010, 11:37am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101 "2010-10-01T11:37:46Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Tony\_Collins](https://avatars.discourse-cdn.com/v4/letter/t/ed8c4c/32.png) [@Tony\_Collins](https://community.wowza.com/u/Tony_Collins)\ **Post date:** [February 6, 2013, 6:26pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/21 "2013-02-06T18:26:19Z")
I have a basic question regarding the event sequence in external method security. I have a password protected page: [http://URL1](http://URL1) which loads the HTML5 player in the customer’s IPhone/IPad to play [http://IP:1935/application/mystream](http://IP:1935/application/mystream) I have script [https://URL2](https://URL2) which returns the key generated in /keys/mystream.key generated by genkey.bat I am trying to confirm that my server will only stream to the HTML5 player in [http://URL1](http://URL1) Where is [https://URL2](https://URL2) called from to prevent direct linking to [http://IP:1935/application/mystream](http://IP:1935/application/mystream) from anywhere other than [http://URL1?](http://URL1?) ---
**Author:** ![Christian\_Olsson](https://avatars.discourse-cdn.com/v4/letter/c/65b543/32.png) [@Christian\_Olsson](https://community.wowza.com/u/Christian_Olsson)\ **Post date:** [February 24, 2015, 8:17pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/22 "2015-02-24T20:17:16Z")
How do you automatically generate keys for livestreams on publishing, i.e when a streamer connects and starts streaming to our wowza server (we don’t want to do anything manually)? We are using transcoding to 3 different qualities and origin-edge and plan do use nDVR in the future if that makes any difference. quote from above regarding automation: “Note: You can also use the genkey utility to generate key files. A key file with a different key is generated each time you run this utility. You can integrate this utility into an automated workflow to create many .key files for a video library.” ---
**Author:** ![Abed\_Dhair](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Abed\_Dhair](https://community.wowza.com/u/Abed_Dhair)\ **Post date:** [June 20, 2013, 12:58pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/23 "2013-06-20T12:58:41Z")
Hello I’m currently using VOD Stream type with External Method encryption without DRM, I have read about key rotation feature and i would like to use it, what i want to achieve is that each group of n files is encrypted using a different key. For example the first 10 ts files use a key then the next 10 ts files uses a different key. How can i do this in my current setup ? Thanks ---
**Author:** ![Abed\_Dhair](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Abed\_Dhair](https://community.wowza.com/u/Abed_Dhair)\ **Post date:** [June 23, 2013, 11:01am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/24 "2013-06-23T11:01:30Z")
Hello Richard This sounds great, but can i do it in a way where i can pre-know the encryption key that will be used for n number of ts files. Helix supports a feature where you can use a different pre-known key for every ts file. ---
**Author:** ![Abed\_Dhair](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Abed\_Dhair](https://community.wowza.com/u/Abed_Dhair)\ **Post date:** [June 28, 2013, 4:25am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/25 "2013-06-28T04:25:38Z")
Hello Richard I will postpone this to a later phase in the future, now i have another question. I’m using external method as i told you before, i’m streaming content from amazon s3 bucket using MediaCache addon. Now the encryption is not happening !! is MediaCache compatible with encryption? if so what should i change to make it work again. Thanks ---
**Author:** ![Abed\_Dhair](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Abed\_Dhair](https://community.wowza.com/u/Abed_Dhair)\ **Post date:** [June 30, 2013, 1:10pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/26 "2013-06-30T13:10:23Z")
Hello Richard To test my work, i made a new wowza server on different server. I used out of the box Application.xml found in conf/Application.xml and followed the instructions from MediaCache User Guide: 1. Copy lib/wms-plugin-mediacache.jar from this package into the Wowza Server folder [install-dir]/lib folder 2. Copy conf/MediaCache.xml from this package into the[install-dir]/conf folder Wowza Server folder 3. Create the folder [install-dir]/application/mediacache 4. Create the folder [install-dir]/conf/mediacache and copy the [install-dir]/conf/Applications.xml into this new folder. 5. Edit the newly copied Application.xml file and make the following changes: a. Set the RTP/Authentication/PlayMethod to: none b. Add the following property to the MediaReader/Properties so that the section looks like this: randomAccessReaderClass com.wowza.wms.plugin.mediacache.impl.MediaCacheRandomAccessReader bufferSeekIO true Boolean 1. Edit [install-dir]/conf/Server.xml and add a reference to the MediaCacheServerListener class in the section: com.wowza.wms.plugin.mediacache.impl.MediaCacheServerListener 1. Then in conf/MediaCache.xml i uncommented the following: awsAccessKeyId MyawsAccessKeyId awsSecretAccessKey MyawsSecretAccessKey And in i set the to [http://s3.amazonaws.com/](http://s3.amazonaws.com/)/SubFolderName/ It reads very well from amazon using this setup, now to enable external Method URL, i have only to create a key file with same mp4 file name and place it in keys directory. Anything wrong i’m doing in here ? Maybe i should change details (, or ) in conf/mediacache/Applications.xml !!! Thanks ---
**Author:** ![Abed\_Dhair](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Abed\_Dhair](https://community.wowza.com/u/Abed_Dhair)\ **Post date:** [July 1, 2013, 9:42am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/27 "2013-07-01T09:42:02Z")
I’m already using it, same like the example myStream.php found in external method and inserting it in ./genkey.sh . I have checked, if i use the same config without mediacache configuration enabled in Application.xml it works like a charm but with mediacache enabled it doesn’t do encryption. Any Ideas !! Abed Abu Dhair ---
**Author:** ![Abed\_Dhair](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Abed\_Dhair](https://community.wowza.com/u/Abed_Dhair)\ **Post date:** [July 2, 2013, 10:12am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/28 "2013-07-02T10:12:22Z")
Hello Richard After testing all scenarios, i found the problem was in the keys folder. I had to create a subdirectory inside the keys folder with the same name of configured MediaCacheSource and that solved the problem. For example in conf/MediaCache.xml the MediaCacheSource name used is http so you have to create keys/html and place your keys inside it. Thanks for your support ---
**Author:** ![Doug\_Maupin](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Doug\_Maupin](https://community.wowza.com/u/Doug_Maupin)\ **Post date:** [May 11, 2014, 12:37pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/29 "2014-05-11T12:37:55Z")
For the streams themselves or the site where i have the php file? ---
**Author:** ![Charlie\_Good](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/charlie_good/32/383_2.png) [@Charlie\_Good](https://community.wowza.com/u/Charlie_Good)\ **Post date:** [November 14, 2011, 4:34am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/30 "2011-11-14T04:34:17Z")
I do not think there is a way to change this message. Charlie ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [September 1, 2011, 7:30pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/31 "2011-09-01T19:30:20Z")
Indika, You can use HTTProviders and HTTPUTils. I.e. call and process response from HTTProvider on one Wowza server with HTTPUtils on another Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [September 2, 2011, 11:15am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/32 "2011-09-02T11:15:39Z")
Indika, AES is for encrypting Cupertino streams. Nothing to do with Wowza server to Wowza server communcations. Here are some examples of HTTProviders: [https://www.wowza.com/docs/http-provider-code-examples-for-wowza-media-server](https://www.wowza.com/docs/http-provider-code-examples-for-wowza-media-server) HTTPUtils is an API included in Wowza to load and process HTTP resources, such as HTTProviders. See the Wowza ServerSide API for more info. Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [September 6, 2011, 2:14am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/33 "2011-09-06T02:14:37Z")
You just follow one of these guides: [https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method](https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method)) [https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming](https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming)) Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [September 6, 2011, 10:30pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/34 "2011-09-06T22:30:33Z")
Did you copy the generated keys to [wowza-install-dir]/keys folder (step 3)? Zip up the conf _and_ logs _and_ keys folders, and send them to support@wowza.com. Include a link to this thread for reference. Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [September 6, 2011, 11:03pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/35 "2011-09-06T23:03:24Z")
I think you can just generate one and copy it to different stream names. When files are in sub-folders, the path is part of the stream name. So you should include full name when generating key. Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [September 7, 2011, 12:48pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/36 "2011-09-07T12:48:45Z")
Indika, Take a look at IMediaWriterActionNotify interface: [https://www.wowza.com/docs/how-to-use-imediawriteractionnotify-to-programmatically-move-and-rename-recordings-of-live-streams](https://www.wowza.com/docs/how-to-use-imediawriteractionnotify-to-programmatically-move-and-rename-recordings-of-live-streams) You can use onWriteComplete event handler to write a key file after each recording. You could use a template key file and just make a copy using java.io.File API Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [September 7, 2011, 5:00pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/37 "2011-09-07T17:00:08Z")
Indika, I see, my mistake. No, that event will not fire. If you are providing an upload mechanism, a php or asp page, you can do the same there: copy a template key to new file with the correct name. Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [November 17, 2011, 11:34pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/38 "2011-11-17T23:34:47Z")
What is [stream-name] ? Is it a simple name like “myStream”, and you have the rtmp address of the origin in /originURL? If so, try using a .stream file instead. Create a text file named origin.stream in the content folder: /content/origin.stream, with contents: rtmp://[wowza-address]:1935/liveorigin/_definst_/myStream Now use stream name “origin.stream” Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [November 18, 2011, 11:28pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/39 "2011-11-18T23:28:02Z")
I’m not sure. Zip up the conf, logs and keys folders and send them to support@wowza.com If you can, delete the current access log then restart Wowza and do some tests, then send that log with /conf and /keys Richard ---
**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\ **Post date:** [November 18, 2011, 11:29pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/40 "2011-11-18T23:29:19Z")
Don’t turn on DEBUG level logging, leave it as INFO, which is default (if you haven’t made a change there is nothing to do) Richard [Previous page](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101.md?page=1) [Next page](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101.md?page=3)