I just wanted to share the findings and resolution to a problem I encountered while migrating to a new AWS EC2 instance running Wowza Streaming Engine 4.11, in case anyone else runs into the same issue.
The Wowza documentation around SSL certificates explains that you can use certificates other than StreamLock, including generating your own self-signed certificate using keytool. Although it isn’t explicitly stated as a requirement, the example commands generate a 2048-bit RSA certificate.
In our configuration, we use a Let’s Encrypt certificate generated by Certbot rather than StreamLock.
As part of the EC2 migration, we moved from x86 to ARM and from the end-of-life Amazon Linux 2 to Amazon Linux 2023. One less obvious consequence was that our Certbot version changed from v1.x to a modern version.
The old version of Certbot defaulted to generating RSA certificates, whereas Certbot 2.0+ defaults to ECDSA certificates for new certificates.
With the ECDSA certificate installed in Wowza, everything initially appeared to be working correctly. The SSL connection and WebRTC signalling worked, and when starting a WebRTC broadcast the ICE connection successfully reached connected.
However, no media packets were subsequently sent. Looking in chrome://webrtc-internals eventually revealed:
iceState: connected
dtlsState: failed
There wasn’t an obvious Wowza error pointing towards the SSL certificate as the cause, which made this quite difficult to diagnose.
As a test, I requested and installed a Wowza StreamLock certificate, which uses a 2048-bit RSA key. WebRTC broadcasting immediately worked.
I then reissued our Let’s Encrypt certificate with Certbot, explicitly requesting RSA:
--key-type rsa --rsa-key-size 2048
After converting that certificate to the JKS format used by Wowza, WebRTC broadcasting also worked immediately.
So, at least with our Wowza 4.11.3 / ARM / Amazon Linux 2023 configuration, an ECDSA certificate resulted in ICE connecting but the subsequent DTLS negotiation failing, while both the StreamLock RSA certificate and a Let’s Encrypt RSA 2048 certificate worked correctly.
Hopefully this saves someone else a fair amount of head-scratching if they encounter the same symptoms after a server or Certbot upgrade.