How to Stream to Icecast with ssl (https)

[daw654]

Hi, I've set up a liquid soap instance and got it running on port 8000 but not sure how to stream with SSL so the Icecast stream has HTTPS.

My Icecast server has SSL working on port 443 and I can connect to it on a PC via B.U.T.T.

Any ideas?

*Edit - Icecast already creates the stream on port 443 anyway so discard this question.

[vitoyucepi]

Hello @daw654.
If you use liquidsoap and icecast on the same computer, you may not configure https for streaming from liquidsoap to icecast.

Liquidsoap supports ssl certificate configuration for inbound streaming

• https://www.liquidsoap.info/doc-2.0.2/harbor.html
• http://www.liquidsoap.info/book/book.pdf pages 84, 160

I've never tried to setup ssl with liquidsoap and icecast, because it's very primitive.
It lacks of options such as

• setup individual certs;
• setup certificate authority.

Maybe the better way is to setup an nginx gateway, because it supports a lot of ssl options.

Generally speaking about input.harbor.ssl
You can generate self-signed cert with command

openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout server.key -out server.crt -subj "/CN=localhost" -days 3650

And then run this liquidsoap script.

settings.harbor.ssl.certificate.set("server.crt")
settings.harbor.ssl.private_key.set("server.key")

a = input.harbor.ssl(port = 8000, "live")
output.harbor.ssl(port = 8001, mount = "radio", %mp3, mksafe(a))

Remember not all streaming clients will support ssl streaming.
For example older versions of ffmpeg were not able to use https for icecast protocol streaming.
You can listen to your radio with command

ffplay https://localhost:8001/radio

And stream with command

ffmpeg -re -i 1.mp3 -vn -c:a copy -tls 1 -f mp3 icecast://source:hackme@localhost:8000/live

This is the liquidsoap part.
I must notice that relaying to icecast instead of output.harbor.ssl is preferable.
The main idea of ssl is to verify host identity and protect traffic.
The ffmpeg in my example doesn't perform cert verification. So it'll be possible to redirect traffic to intermediate host and re-crypt it with another self-signed cert.