Wowza seems to stop working over https prior to Letsencrypt expiring

[Elie_Obeid]

We have a centos 7 LAMP server and two other centos 7 Wowza 4.8.0 connected by Wowza load balancer. All the servers have the correct Linux date. All the servers have the same let’s encrypt certificate which expires today 17/9/2020.

All the servers are offline and so the SSL has to be renewed manually every 3 months via the DNS verification method. Basically I generate a wildcard certificate on my PC, upload it to the Wowza server, use this tool, And run this command

/usr/local/WowzaStreamingEngine/java/bin/java -jar /usr/bin/wowza-letsencrypt-converter-0.2.jar /usr/local/WowzaStreamingEngine/conf/ssl/ /etc/letsencrypt/live/ && systemctl restart WowzaStreamingEngine

Today I was renewing the certificates, the certificate was working fine on the LAMP server, but was expired on both Wowza servers, chrome tells me that the certificate will expire tomorrow but if you try to watch something over https, it won’t play and the developer console will say certificate invalid, if you try accessing the Wowza manager, it will say the same.

I don’t know for how long it’s been like that, I don’t check the servers on a daily basis, maybe a week, no clue. Is there a reason for Wowza to mark the certificate as invalid before the expiration date? If so can we fix it? and how long before the actual expiration date does the certificate expires? So we can take that into account.

[Rose_Power-Wowza_Com]

Let me check with tech support on this for you

[Elie_Obeid]

Thank you so much, please ask them about this too

DRM - loadbalancer: do the keys have to be on both servers?

Wowza drm I’m currently placing the keys in the [installation-dir]keys/ folder Our client have 2 streaming engines and a wowza load balancer, should the keys folder be created on both servers? should be a shared one? or if it exists on one server, the other server will detect it?

[Rose_Power-Wowza_Com]

I responded in the other post for this so we can mark it as accepted solution for that question when people search.

[Rose_Power-Wowza_Com]

For this question @Elie_Obeid, tech support wants to review your certs in a ticket. They need a better understanding of this behavior to see what we may need to do to improve upon the messaging around cert expirations specific to Let’s Encrypt vs our Streamlock. I know we’re trying to make some automated changes and we are currently testing this so a ticket to help with this would be much appreciated.

[Elie_Obeid]

Sure, I can provide them with new certificates that are valid until 16/9/2020, I can’t provide the old certificates because I don’t have them, they got deleted when applying the new ones.