# Using Certbot generated SSL **URL:** \ **Category:** Wowza Streaming Engine\ **Created:** [August 27, 2026, 8:47am UTC](https://community.wowza.com/t/using-certbot-generated-ssl/102850 "2026-08-27T08:47:01Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Pip\_Nason1](https://avatars.discourse-cdn.com/v4/letter/p/dc4da7/32.png) [@Pip\_Nason1](https://community.wowza.com/u/Pip_Nason1)\ **Post date:** [August 27, 2026, 8:47am UTC](https://community.wowza.com/t/using-certbot-generated-ssl/102850/1 "2026-08-27T08:47:01Z")
I just wanted to share the findings and resolution to a problem I encountered while migrating to a new AWS EC2 instance running Wowza Streaming Engine 4.11, in case anyone else runs into the same issue. The Wowza documentation around SSL certificates explains that you can use certificates other than StreamLock, including generating your own self-signed certificate using `keytool`. Although it isn’t explicitly stated as a requirement, the example commands generate a **2048-bit RSA certificate**. In our configuration, we use a **Let’s Encrypt certificate generated by Certbot** rather than StreamLock. As part of the EC2 migration, we moved from x86 to ARM and from the end-of-life Amazon Linux 2 to Amazon Linux 2023. One less obvious consequence was that our Certbot version changed from **v1.x to a modern version**. The old version of Certbot defaulted to generating **RSA certificates** , whereas Certbot 2.0+ defaults to **ECDSA certificates** for new certificates. With the ECDSA certificate installed in Wowza, everything initially appeared to be working correctly. The SSL connection and WebRTC signalling worked, and when starting a WebRTC broadcast the **ICE connection successfully reached `connected`**. However, no media packets were subsequently sent. Looking in `chrome://webrtc-internals` eventually revealed: `iceState: connected` `dtlsState: failed` There wasn’t an obvious Wowza error pointing towards the SSL certificate as the cause, which made this quite difficult to diagnose. As a test, I requested and installed a **Wowza StreamLock certificate** , which uses a 2048-bit RSA key. WebRTC broadcasting immediately worked. I then reissued our Let’s Encrypt certificate with Certbot, explicitly requesting RSA: `--key-type rsa --rsa-key-size 2048` After converting that certificate to the JKS format used by Wowza, WebRTC broadcasting also worked immediately. So, at least with our **Wowza 4.11.3 / ARM / Amazon Linux 2023** configuration, an ECDSA certificate resulted in ICE connecting but the subsequent DTLS negotiation failing, while both the StreamLock RSA certificate and a Let’s Encrypt RSA 2048 certificate worked correctly. Hopefully this saves someone else a fair amount of head-scratching if they encounter the same symptoms after a server or Certbot upgrade. ---
**Author:** ![Jason\_Hilton](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/jason_hilton/32/437_2.png) [@Jason\_Hilton](https://community.wowza.com/u/Jason_Hilton)\ **Post date:** [September 1, 2026, 8:14am UTC](https://community.wowza.com/t/using-certbot-generated-ssl/102850/2 "2026-09-01T08:14:22Z")
Hi **[Pip\_Nason1](https://community.wowza.com/u/pip_nason1)**, Thank you so much for sharing this information which may help others with a similar problem to the one you were facing. I’m glad to hear you were able to identify the issue and fix it. I’ll pass this feedback along internally as a discussion on this may result in a feature request on our side to improve our logging to make an issue like this more obvious so it can be fixed sooner. Regards, **Jason Hilton** Senior Technical Support Engineer **WOWZA** | _The **solution** you start with, the **partner** you scale with._ **[Manage your Support cases online](https://urldefense.com/v3/ __https://portal.wowza.com/account/support__ ;!!GFN0sa3rsbfR8OLyAw!b21Ye3sPxunm4p5NSvmBLvIcMnA6OS9j4Q6GGF5By3Zd2KpmqFACOzAHUWnC8Y2Wwq_lhoVkvzxWGfdtbeYvJI9QnQ$)** **Bookmark our [FAQ page](https://urldefense.com/v3/ __https://support.wowza.com/hc/en-us__ ;!!GFN0sa3rsbfR8OLyAw!b21Ye3sPxunm4p5NSvmBLvIcMnA6OS9j4Q6GGF5By3Zd2KpmqFACOzAHUWnC8Y2Wwq_lhoVkvzxWGfdtbeZS3JTgtA$)** **Bookmark our[Status page](https://urldefense.com/v3/ __https://status.wowza.com/__ ;!!GFN0sa3rsbfR8OLyAw!b21Ye3sPxunm4p5NSvmBLvIcMnA6OS9j4Q6GGF5By3Zd2KpmqFACOzAHUWnC8Y2Wwq_lhoVkvzxWGfdtbebL9JPWqQ$)** ![](https://api-na1.hubspot.com/filemanager/api/v2/files/211975431836/signed-url-redirect?portalId=229276) ---
**Author:** ![Alex\_C](https://avatars.discourse-cdn.com/v4/letter/a/bbe5ce/32.png) [@Alex\_C](https://community.wowza.com/u/Alex_C)\ **Post date:** [September 1, 2026, 12:49pm UTC](https://community.wowza.com/t/using-certbot-generated-ssl/102850/3 "2026-09-01T12:49:32Z")
@Pip_Nason1 If you check in the Virtual Host Setup, which WebRTC WebSocket Implementation did you have setup? Try setting it to “WebRTC” not Legacy or Dynamic and see if the same issue happens with that ECDSA cert. Alex Chepurnoy