From Wang at pc-factory.at  Mon Jan  4 18:00:50 2021
From: Wang at pc-factory.at (Wangr)
Date: Mon, 4 Jan 2021 19:00:50 +0100
Subject: [Icecast] Icecast and HTTPS
Message-ID: <20210104180050.GA29211@pc-factory.at>

Hello to all!

I have tried for days now to use icecast2 (version 2.4.99.2) with
HTTPS. Been through so many manuals and howtos, but nothing works.

I have used the Debian version, as well as compiled from source.

Ports 8000 and 8443 are open on the firewall.


Here is some relevant info:

/etc/icecast2/icecast.xml:

<listen-socket>
  <port>8000</port>
</listen-socket>
<listen-socket>
  <port>8443</port>
  <ssl>1</ssl>
</listen-socket>

<http-headers>
  <header name="Access-Control-Allow-Origin" value="*" />
</http-headers>

<paths>
  <basedir>/usr/share/icecast2</basedir>
  <logdir>/var/log/icecast2</logdir>
  <webroot>/usr/share/icecast2/web</webroot>
  <adminroot>/usr/share/icecast2/admin</adminroot>
  <alias source="/" destination="/status.xsl"/>
  <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-certificate>
  <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-key>
</paths>

The bundle.pem file contains the privkey.pem and fullchain.pem files
of the dehydrated (let's encrypt) certificates, in this order.


ices2 config file:

<instance>
  <port>8443</port>
</instance>

with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).


I am thankful for any help!


From norbert.deleutre at umontpellier.fr  Mon Jan  4 19:14:56 2021
From: norbert.deleutre at umontpellier.fr (Norbert Deleutre)
Date: Mon, 4 Jan 2021 20:14:56 +0100 (CET)
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <20210104180050.GA29211@pc-factory.at>
References: <20210104180050.GA29211@pc-factory.at>
Message-ID: <1173302304.17505801.1609787696333.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>

I had made the same resquest in septembre 2020.
And my conclusion is that icecast doesn?t Work with ssl- 

?-
N.D
LMGC


> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
> 
> ?Hello to all!
> 
> I have tried for days now to use icecast2 (version 2.4.99.2) with
> HTTPS. Been through so many manuals and howtos, but nothing works.
> 
> I have used the Debian version, as well as compiled from source.
> 
> Ports 8000 and 8443 are open on the firewall.
> 
> 
> Here is some relevant info:
> 
> /etc/icecast2/icecast.xml:
> 
> <listen-socket>
> <port>8000</port>
> </listen-socket>
> <listen-socket>
> <port>8443</port>
> <ssl>1</ssl>
> </listen-socket>
> 
> <http-headers>
> <header name="Access-Control-Allow-Origin" value="*" />
> </http-headers>
> 
> <paths>
> <basedir>/usr/share/icecast2</basedir>
> <logdir>/var/log/icecast2</logdir>
> <webroot>/usr/share/icecast2/web</webroot>
> <adminroot>/usr/share/icecast2/admin</adminroot>
> <alias source="/" destination="/status.xsl"/>
> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-certificate>
> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-key>
> </paths>
> 
> The bundle.pem file contains the privkey.pem and fullchain.pem files
> of the dehydrated (let's encrypt) certificates, in this order.
> 
> 
> ices2 config file:
> 
> <instance>
> <port>8443</port>
> </instance>
> 
> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
> 
> 
> I am thankful for any help!
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast

From jmcharry at gmx.net  Mon Jan  4 19:33:57 2021
From: jmcharry at gmx.net (John McHarry)
Date: Mon, 04 Jan 2021 14:33:57 -0500
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <1173302304.17505801.1609787696333.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
References: <20210104180050.GA29211@pc-factory.at>
 <1173302304.17505801.1609787696333.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
Message-ID: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>

It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
icecast2 server. Check http://audio-mp3.ibiblio.org:8000


On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
> I had made the same resquest in septembre 2020.
> And my conclusion is that icecast doesn?t Work with ssl-
>
> ?-
> N.D
> LMGC
>
>
> > Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
> >
> > ?Hello to all!
> >
> > I have tried for days now to use icecast2 (version 2.4.99.2) with
> > HTTPS. Been through so many manuals and howtos, but nothing works.
> >
> > I have used the Debian version, as well as compiled from source.
> >
> > Ports 8000 and 8443 are open on the firewall.
> >
> >
> > Here is some relevant info:
> >
> > /etc/icecast2/icecast.xml:
> >
> > <listen-socket>
> > <port>8000</port>
> > </listen-socket>
> > <listen-socket>
> > <port>8443</port>
> > <ssl>1</ssl>
> > </listen-socket>
> >
> > <http-headers>
> > <header name="Access-Control-Allow-Origin" value="*" />
> > </http-headers>
> >
> > <paths>
> > <basedir>/usr/share/icecast2</basedir>
> > <logdir>/var/log/icecast2</logdir>
> > <webroot>/usr/share/icecast2/web</webroot>
> > <adminroot>/usr/share/icecast2/admin</adminroot>
> > <alias source="/" destination="/status.xsl"/>
> > <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
> > certificate>
> > <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
> > key>
> > </paths>
> >
> > The bundle.pem file contains the privkey.pem and fullchain.pem
> > files
> > of the dehydrated (let's encrypt) certificates, in this order.
> >
> >
> > ices2 config file:
> >
> > <instance>
> > <port>8443</port>
> > </instance>
> >
> > with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
> >
> >
> > I am thankful for any help!
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast



From norbert.deleutre at umontpellier.fr  Mon Jan  4 19:56:05 2021
From: norbert.deleutre at umontpellier.fr (Norbert Deleutre)
Date: Mon, 4 Jan 2021 20:56:05 +0100 (CET)
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
Message-ID: <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>

With a free player ?  Which one ? 

?-
N.D
LMGC


> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
> 
> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
> 
> 
> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
> > I had made the same resquest in septembre 2020.
> > And my conclusion is that icecast doesn?t Work with ssl-
> >
> > ?-
> > N.D
> > LMGC
> >
> >
> > > Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
> > >
> > > ?Hello to all!
> > >
> > > I have tried for days now to use icecast2 (version 2.4.99.2) with
> > > HTTPS. Been through so many manuals and howtos, but nothing works.
> > >
> > > I have used the Debian version, as well as compiled from source.
> > >
> > > Ports 8000 and 8443 are open on the firewall.
> > >
> > >
> > > Here is some relevant info:
> > >
> > > /etc/icecast2/icecast.xml:
> > >
> > > <listen-socket>
> > > <port>8000</port>
> > > </listen-socket>
> > > <listen-socket>
> > > <port>8443</port>
> > > <ssl>1</ssl>
> > > </listen-socket>
> > >
> > > <http-headers>
> > > <header name="Access-Control-Allow-Origin" value="*" />
> > > </http-headers>
> > >
> > > <paths>
> > > <basedir>/usr/share/icecast2</basedir>
> > > <logdir>/var/log/icecast2</logdir>
> > > <webroot>/usr/share/icecast2/web</webroot>
> > > <adminroot>/usr/share/icecast2/admin</adminroot>
> > > <alias source="/" destination="/status.xsl"/>
> > > <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
> > > certificate>
> > > <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
> > > key>
> > > </paths>
> > >
> > > The bundle.pem file contains the privkey.pem and fullchain.pem
> > > files
> > > of the dehydrated (let's encrypt) certificates, in this order.
> > >
> > >
> > > ices2 config file:
> > >
> > > <instance>
> > > <port>8443</port>
> > > </instance>
> > >
> > > with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
> > >
> > >
> > > I am thankful for any help!
> > > _______________________________________________
> > > Icecast mailing list
> > > Icecast at xiph.org
> > > http://lists.xiph.org/mailman/listinfo/icecast
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> 
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast

From epirat07 at gmail.com  Mon Jan  4 19:58:33 2021
From: epirat07 at gmail.com (Marvin Scholz)
Date: Mon, 04 Jan 2021 20:58:33 +0100
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
Message-ID: <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>

Icecast does support TLS and nearly all modern players
do support streams over HTTPS too.

On 4 Jan 2021, at 20:56, Norbert Deleutre wrote:

> With a free player ?  Which one ?
>
> ?-
> N.D
> LMGC
>
>
>> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
>>
>> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
>> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
>>
>>
>> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
>>> I had made the same resquest in septembre 2020.
>>> And my conclusion is that icecast doesn?t Work with ssl-
>>>
>>> ?-
>>> N.D
>>> LMGC
>>>
>>>
>>>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
>>>>
>>>> ?Hello to all!
>>>>
>>>> I have tried for days now to use icecast2 (version 2.4.99.2) with
>>>> HTTPS. Been through so many manuals and howtos, but nothing works.
>>>>
>>>> I have used the Debian version, as well as compiled from source.
>>>>
>>>> Ports 8000 and 8443 are open on the firewall.
>>>>
>>>>
>>>> Here is some relevant info:
>>>>
>>>> /etc/icecast2/icecast.xml:
>>>>
>>>> <listen-socket>
>>>> <port>8000</port>
>>>> </listen-socket>
>>>> <listen-socket>
>>>> <port>8443</port>
>>>> <ssl>1</ssl>
>>>> </listen-socket>
>>>>
>>>> <http-headers>
>>>> <header name="Access-Control-Allow-Origin" value="*" />
>>>> </http-headers>
>>>>
>>>> <paths>
>>>> <basedir>/usr/share/icecast2</basedir>
>>>> <logdir>/var/log/icecast2</logdir>
>>>> <webroot>/usr/share/icecast2/web</webroot>
>>>> <adminroot>/usr/share/icecast2/admin</adminroot>
>>>> <alias source="/" destination="/status.xsl"/>
>>>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
>>>> certificate>
>>>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
>>>> key>
>>>> </paths>
>>>>
>>>> The bundle.pem file contains the privkey.pem and fullchain.pem
>>>> files
>>>> of the dehydrated (let's encrypt) certificates, in this order.
>>>>
>>>>
>>>> ices2 config file:
>>>>
>>>> <instance>
>>>> <port>8443</port>
>>>> </instance>
>>>>
>>>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
>>>>
>>>>
>>>> I am thankful for any help!
>>>> _______________________________________________
>>>> Icecast mailing list
>>>> Icecast at xiph.org
>>>> http://lists.xiph.org/mailman/listinfo/icecast
>>> _______________________________________________
>>> Icecast mailing list
>>> Icecast at xiph.org
>>> http://lists.xiph.org/mailman/listinfo/icecast
>>
>> _______________________________________________
>> Icecast mailing list
>> Icecast at xiph.org
>> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast


From zer0___ at hotmail.com  Mon Jan  4 20:56:27 2021
From: zer0___ at hotmail.com (_zer0_ gravity)
Date: Mon, 4 Jan 2021 20:56:27 +0000
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
Message-ID: <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>

There are some things to consider if you want Icecast to serve https:

The ssl certificate file needs BOTH the private key AND the chain into one file. The order did not make a difference in my setups.
The <ssl-private-key> is not needed, only the <ssl-certificate>

Make sure that the icecast2 user is the owner of the certificate:
chown icecast2:icecast /usr/share/icecast2/icecast.pem

Make sure NOT to put it in the "web" directory, the pem file should NOT be publicly accessible.
I have used both /etc/icecast2/ and /usr/share/icecast2/ directories successfully.

I am using letsencrypt and have use a post-hook script so that it only updates after a new certificate has been deployed:
#!/bin/bash
/bin/cat /etc/letsencrypt/live/YOURDOMAIN/privkey.pem /etc/letsencrypt/live/ YOURDOMAIN/fullchain.pem > /usr/share/icecast2/icecast.pem && /usr/bin/systemctl restart icecast2

Make sure you are NOT using the version from the Debian repositories, as they are compiled without SSL support.
Instead use the repositories described here: https://wiki.xiph.org/Icecast_Server/Installing_latest_version_(official_Xiph_repositories)

I also had to add a priority file to make sure apt grabs the right one, as the version number on both repositories is the same, but only the version on the official Xiph repo has SSL support.
After adding the official xiph repository add a file /etc/apt/preferences.d/icecast with the following:

Package: icecast2
Pin: origin "download.opensuse.org"
Pin-Priority: 999

Then do a reinstall with:

apt update
apt reinstall icecast2

This are the relevant parts of my icecast2.xml:

    <listen-socket>
        <port>8443</port>
        <ssl>1</ssl>
    </listen-socket>

    <ssl-certificate>/usr/share/icecast2/icecast.pem</ssl-certificate>

Of course restart icecast2 after updating the ssl-certificate as it is only read during startup, that is also why I do a restart (and not a reload) in the certbot post-hook:
Systemctl restart icecast2
Also close and reopen your browser to test so that you are sure the certificate is not being cached locally.

Worked for me with Debian 9 and 10.

Regards, Paul


-----Oorspronkelijk bericht-----
Van: Icecast <icecast-bounces at xiph.org> Namens Marvin Scholz
Verzonden: Monday, 4 January 2021 20:59
Aan: Icecast streaming server user discussions <icecast at xiph.org>
Onderwerp: Re: [Icecast] Icecast and HTTPS

Icecast does support TLS and nearly all modern players do support streams over HTTPS too.

On 4 Jan 2021, at 20:56, Norbert Deleutre wrote:

> With a free player ?  Which one ?
>
> ?-
> N.D
> LMGC
>
>
>> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
>>
>> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
>> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
>>
>>
>> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
>>> I had made the same resquest in septembre 2020.
>>> And my conclusion is that icecast doesn?t Work with ssl-
>>>
>>> ?-
>>> N.D
>>> LMGC
>>>
>>>
>>>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
>>>>
>>>> ?Hello to all!
>>>>
>>>> I have tried for days now to use icecast2 (version 2.4.99.2) with 
>>>> HTTPS. Been through so many manuals and howtos, but nothing works.
>>>>
>>>> I have used the Debian version, as well as compiled from source.
>>>>
>>>> Ports 8000 and 8443 are open on the firewall.
>>>>
>>>>
>>>> Here is some relevant info:
>>>>
>>>> /etc/icecast2/icecast.xml:
>>>>
>>>> <listen-socket>
>>>> <port>8000</port>
>>>> </listen-socket>
>>>> <listen-socket>
>>>> <port>8443</port>
>>>> <ssl>1</ssl>
>>>> </listen-socket>
>>>>
>>>> <http-headers>
>>>> <header name="Access-Control-Allow-Origin" value="*" /> 
>>>> </http-headers>
>>>>
>>>> <paths>
>>>> <basedir>/usr/share/icecast2</basedir>
>>>> <logdir>/var/log/icecast2</logdir>
>>>> <webroot>/usr/share/icecast2/web</webroot>
>>>> <adminroot>/usr/share/icecast2/admin</adminroot>
>>>> <alias source="/" destination="/status.xsl"/>
>>>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
>>>> certificate>
>>>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
>>>> key>
>>>> </paths>
>>>>
>>>> The bundle.pem file contains the privkey.pem and fullchain.pem 
>>>> files of the dehydrated (let's encrypt) certificates, in this 
>>>> order.
>>>>
>>>>
>>>> ices2 config file:
>>>>
>>>> <instance>
>>>> <port>8443</port>
>>>> </instance>
>>>>
>>>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
>>>>
>>>>
>>>> I am thankful for any help!
>>>> _______________________________________________
>>>> Icecast mailing list
>>>> Icecast at xiph.org
>>>> http://lists.xiph.org/mailman/listinfo/icecast
>>> _______________________________________________
>>> Icecast mailing list
>>> Icecast at xiph.org
>>> http://lists.xiph.org/mailman/listinfo/icecast
>>
>> _______________________________________________
>> Icecast mailing list
>> Icecast at xiph.org
>> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
_______________________________________________
Icecast mailing list
Icecast at xiph.org
http://lists.xiph.org/mailman/listinfo/icecast

From zer0___ at hotmail.com  Mon Jan  4 21:06:22 2021
From: zer0___ at hotmail.com (_zer0_ gravity)
Date: Mon, 4 Jan 2021 21:06:22 +0000
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
Message-ID: <AM4PR0401MB22902B4AF847266564ED3CE5CDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>

BTW, if you are on an ARM device like the Raspberry Pi you have to compile icecast2 from source to get ssl support !
There is only an ARM64 version available for Debian 9.

Paul

-----Oorspronkelijk bericht-----
Van: Icecast <icecast-bounces at xiph.org> Namens _zer0_ gravity
Verzonden: Monday, 4 January 2021 21:56
Aan: Icecast streaming server user discussions <icecast at xiph.org>
Onderwerp: Re: [Icecast] Icecast and HTTPS

There are some things to consider if you want Icecast to serve https:

The ssl certificate file needs BOTH the private key AND the chain into one file. The order did not make a difference in my setups.
The <ssl-private-key> is not needed, only the <ssl-certificate>

Make sure that the icecast2 user is the owner of the certificate:
chown icecast2:icecast /usr/share/icecast2/icecast.pem

Make sure NOT to put it in the "web" directory, the pem file should NOT be publicly accessible.
I have used both /etc/icecast2/ and /usr/share/icecast2/ directories successfully.

I am using letsencrypt and have use a post-hook script so that it only updates after a new certificate has been deployed:
#!/bin/bash
/bin/cat /etc/letsencrypt/live/YOURDOMAIN/privkey.pem /etc/letsencrypt/live/ YOURDOMAIN/fullchain.pem > /usr/share/icecast2/icecast.pem && /usr/bin/systemctl restart icecast2

Make sure you are NOT using the version from the Debian repositories, as they are compiled without SSL support.
Instead use the repositories described here: https://wiki.xiph.org/Icecast_Server/Installing_latest_version_(official_Xiph_repositories)

I also had to add a priority file to make sure apt grabs the right one, as the version number on both repositories is the same, but only the version on the official Xiph repo has SSL support.
After adding the official xiph repository add a file /etc/apt/preferences.d/icecast with the following:

Package: icecast2
Pin: origin "download.opensuse.org"
Pin-Priority: 999

Then do a reinstall with:

apt update
apt reinstall icecast2

This are the relevant parts of my icecast2.xml:

    <listen-socket>
        <port>8443</port>
        <ssl>1</ssl>
    </listen-socket>

    <ssl-certificate>/usr/share/icecast2/icecast.pem</ssl-certificate>

Of course restart icecast2 after updating the ssl-certificate as it is only read during startup, that is also why I do a restart (and not a reload) in the certbot post-hook:
Systemctl restart icecast2
Also close and reopen your browser to test so that you are sure the certificate is not being cached locally.

Worked for me with Debian 9 and 10.

Regards, Paul


-----Oorspronkelijk bericht-----
Van: Icecast <icecast-bounces at xiph.org> Namens Marvin Scholz
Verzonden: Monday, 4 January 2021 20:59
Aan: Icecast streaming server user discussions <icecast at xiph.org>
Onderwerp: Re: [Icecast] Icecast and HTTPS

Icecast does support TLS and nearly all modern players do support streams over HTTPS too.

On 4 Jan 2021, at 20:56, Norbert Deleutre wrote:

> With a free player ?  Which one ?
>
> ?-
> N.D
> LMGC
>
>
>> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
>>
>> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
>> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
>>
>>
>> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
>>> I had made the same resquest in septembre 2020.
>>> And my conclusion is that icecast doesn?t Work with ssl-
>>>
>>> ?-
>>> N.D
>>> LMGC
>>>
>>>
>>>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
>>>>
>>>> ?Hello to all!
>>>>
>>>> I have tried for days now to use icecast2 (version 2.4.99.2) with 
>>>> HTTPS. Been through so many manuals and howtos, but nothing works.
>>>>
>>>> I have used the Debian version, as well as compiled from source.
>>>>
>>>> Ports 8000 and 8443 are open on the firewall.
>>>>
>>>>
>>>> Here is some relevant info:
>>>>
>>>> /etc/icecast2/icecast.xml:
>>>>
>>>> <listen-socket>
>>>> <port>8000</port>
>>>> </listen-socket>
>>>> <listen-socket>
>>>> <port>8443</port>
>>>> <ssl>1</ssl>
>>>> </listen-socket>
>>>>
>>>> <http-headers>
>>>> <header name="Access-Control-Allow-Origin" value="*" /> 
>>>> </http-headers>
>>>>
>>>> <paths>
>>>> <basedir>/usr/share/icecast2</basedir>
>>>> <logdir>/var/log/icecast2</logdir>
>>>> <webroot>/usr/share/icecast2/web</webroot>
>>>> <adminroot>/usr/share/icecast2/admin</adminroot>
>>>> <alias source="/" destination="/status.xsl"/>
>>>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
>>>> certificate>
>>>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
>>>> key>
>>>> </paths>
>>>>
>>>> The bundle.pem file contains the privkey.pem and fullchain.pem 
>>>> files of the dehydrated (let's encrypt) certificates, in this 
>>>> order.
>>>>
>>>>
>>>> ices2 config file:
>>>>
>>>> <instance>
>>>> <port>8443</port>
>>>> </instance>
>>>>
>>>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
>>>>
>>>>
>>>> I am thankful for any help!
>>>> _______________________________________________
>>>> Icecast mailing list
>>>> Icecast at xiph.org
>>>> http://lists.xiph.org/mailman/listinfo/icecast
>>> _______________________________________________
>>> Icecast mailing list
>>> Icecast at xiph.org
>>> http://lists.xiph.org/mailman/listinfo/icecast
>>
>> _______________________________________________
>> Icecast mailing list
>> Icecast at xiph.org
>> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
_______________________________________________
Icecast mailing list
Icecast at xiph.org
http://lists.xiph.org/mailman/listinfo/icecast
_______________________________________________
Icecast mailing list
Icecast at xiph.org
http://lists.xiph.org/mailman/listinfo/icecast

From latinfo at vcn.bc.ca  Tue Jan  5 02:15:16 2021
From: latinfo at vcn.bc.ca (latinfo at vcn.bc.ca)
Date: Mon, 4 Jan 2021 18:15:16 -0800
Subject: [Icecast] icecast2 + ices2 Debian Buster and Testing error.
Message-ID: <96fd5500368851fba3e65d734994400a.squirrel@mail.vcn.bc.ca>

The error:

/etc/ices2/ices-playlist.xml
/etc/ices2/ices-playlist.xml: line 1: syntax error near unexpected token
`newline'
/etc/ices2/ices-playlist.xml: line 1: `<?xml version="1.0"?>'

might you help me to resolve it?
thanks.



From hgalt at gmx.net  Tue Jan  5 09:29:12 2021
From: hgalt at gmx.net (hgalt)
Date: Tue, 5 Jan 2021 10:29:12 +0100
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <1173302304.17505801.1609787696333.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
References: <20210104180050.GA29211@pc-factory.at>
 <1173302304.17505801.1609787696333.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
Message-ID: <000601d6e345$3b07bde0$b11739a0$@gmx.net>

Hello Wangr,
I am not using icecast 2.4.99.x but I use 2.4.0-kh15 64-bit for windows. It is also a future 2.5 release.

I figured out something strange with https.
I have configured port 8044 and 8043 for https. Port 8043 is not working at all, but at port 8044 htpps is working fine for streaming and connection.
I like that, because everything is on the same port.

But if do not specify the ssl port, https is not functional. It must be also a different port then the normal port. If I try to use the normal port for ssl too, it is also not working.

I hope it will help you,
Hans-Georg Althoff

-----Urspr?ngliche Nachricht-----
Von: Icecast [mailto:icecast-bounces at xiph.org] Im Auftrag von Norbert Deleutre
Gesendet: Montag, 4. Januar 2021 20:15
An: Icecast streaming server user discussions
Betreff: Re: [Icecast] Icecast and HTTPS

I had made the same resquest in septembre 2020.
And my conclusion is that icecast doesn?t Work with ssl-

?-
N.D
LMGC


> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
>
> ?Hello to all!
>
> I have tried for days now to use icecast2 (version 2.4.99.2) with
> HTTPS. Been through so many manuals and howtos, but nothing works.
>
> I have used the Debian version, as well as compiled from source.
>
> Ports 8000 and 8443 are open on the firewall.
>
>
> Here is some relevant info:
>
> /etc/icecast2/icecast.xml:
>
> <listen-socket>
> <port>8000</port>
> </listen-socket>
> <listen-socket>
> <port>8443</port>
> <ssl>1</ssl>
> </listen-socket>
>
> <http-headers>
> <header name="Access-Control-Allow-Origin" value="*" />
> </http-headers>
>
> <paths>
> <basedir>/usr/share/icecast2</basedir>
> <logdir>/var/log/icecast2</logdir>
> <webroot>/usr/share/icecast2/web</webroot>
> <adminroot>/usr/share/icecast2/admin</adminroot>
> <alias source="/" destination="/status.xsl"/>
> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-certificate>
> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-key>
> </paths>
>
> The bundle.pem file contains the privkey.pem and fullchain.pem files
> of the dehydrated (let's encrypt) certificates, in this order.
>
>
> ices2 config file:
>
> <instance>
> <port>8443</port>
> </instance>
>
> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
>
>
> I am thankful for any help!
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
_______________________________________________
Icecast mailing list
Icecast at xiph.org
http://lists.xiph.org/mailman/listinfo/icecast


--
Diese E-Mail wurde von Avast Antivirus-Software auf Viren gepr?ft.
https://www.avast.com/antivirus



From Wang at pc-factory.at  Tue Jan  5 15:14:11 2021
From: Wang at pc-factory.at (Wang)
Date: Tue, 5 Jan 2021 16:14:11 +0100
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
Message-ID: <20210105151411.GA12225@pc-factory.at>

Thank you all for your answers, especially this one here!

Thank you, Paul, for the many good advices.

I actually got it working! In pretty much the same way you described it. ()

As players I tried with success: mpv, mplayer, vlc, cvlc (Linux).
Also inside an <audio> tag in a https page, it worked!
This was the reason I wanted to use https, because I wanted to embed
the stream in an https site; if icecast runs only with http, chromium
complains; in Firefox it worked well.

_zer0_ gravity <zer0___ at hotmail.com> schrieb am 04.01.2021 20:56:
> There are some things to consider if you want Icecast to serve https:
> 
> The ssl certificate file needs BOTH the private key AND the chain into one file. The order did not make a difference in my setups.
> The <ssl-private-key> is not needed, only the <ssl-certificate>
> 
> Make sure that the icecast2 user is the owner of the certificate:
> chown icecast2:icecast /usr/share/icecast2/icecast.pem
> 
> Make sure NOT to put it in the "web" directory, the pem file should NOT be publicly accessible.
> I have used both /etc/icecast2/ and /usr/share/icecast2/ directories successfully.
> 
> I am using letsencrypt and have use a post-hook script so that it only updates after a new certificate has been deployed:
> #!/bin/bash
> /bin/cat /etc/letsencrypt/live/YOURDOMAIN/privkey.pem /etc/letsencrypt/live/ YOURDOMAIN/fullchain.pem > /usr/share/icecast2/icecast.pem && /usr/bin/systemctl restart icecast2
> 
> Make sure you are NOT using the version from the Debian repositories, as they are compiled without SSL support.
> Instead use the repositories described here: https://wiki.xiph.org/Icecast_Server/Installing_latest_version_(official_Xiph_repositories)
> 
> I also had to add a priority file to make sure apt grabs the right one, as the version number on both repositories is the same, but only the version on the official Xiph repo has SSL support.
> After adding the official xiph repository add a file /etc/apt/preferences.d/icecast with the following:
> 
> Package: icecast2
> Pin: origin "download.opensuse.org"
> Pin-Priority: 999
> 
> Then do a reinstall with:
> 
> apt update
> apt reinstall icecast2
> 
> This are the relevant parts of my icecast2.xml:
> 
>     <listen-socket>
>         <port>8443</port>
>         <ssl>1</ssl>
>     </listen-socket>
> 
>     <ssl-certificate>/usr/share/icecast2/icecast.pem</ssl-certificate>
> 
> Of course restart icecast2 after updating the ssl-certificate as it is only read during startup, that is also why I do a restart (and not a reload) in the certbot post-hook:
> Systemctl restart icecast2
> Also close and reopen your browser to test so that you are sure the certificate is not being cached locally.
> 
> Worked for me with Debian 9 and 10.
> 
> Regards, Paul
> 
> 
> -----Oorspronkelijk bericht-----
> Van: Icecast <icecast-bounces at xiph.org> Namens Marvin Scholz
> Verzonden: Monday, 4 January 2021 20:59
> Aan: Icecast streaming server user discussions <icecast at xiph.org>
> Onderwerp: Re: [Icecast] Icecast and HTTPS
> 
> Icecast does support TLS and nearly all modern players do support streams over HTTPS too.
> 
> On 4 Jan 2021, at 20:56, Norbert Deleutre wrote:
> 
> > With a free player ?  Which one ?
> >
> > ?-
> > N.D
> > LMGC
> >
> >
> >> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
> >>
> >> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
> >> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
> >>
> >>
> >> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
> >>> I had made the same resquest in septembre 2020.
> >>> And my conclusion is that icecast doesn?t Work with ssl-
> >>>
> >>> ?-
> >>> N.D
> >>> LMGC
> >>>
> >>>
> >>>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
> >>>>
> >>>> ?Hello to all!
> >>>>
> >>>> I have tried for days now to use icecast2 (version 2.4.99.2) with 
> >>>> HTTPS. Been through so many manuals and howtos, but nothing works.
> >>>>
> >>>> I have used the Debian version, as well as compiled from source.
> >>>>
> >>>> Ports 8000 and 8443 are open on the firewall.
> >>>>
> >>>>
> >>>> Here is some relevant info:
> >>>>
> >>>> /etc/icecast2/icecast.xml:
> >>>>
> >>>> <listen-socket>
> >>>> <port>8000</port>
> >>>> </listen-socket>
> >>>> <listen-socket>
> >>>> <port>8443</port>
> >>>> <ssl>1</ssl>
> >>>> </listen-socket>
> >>>>
> >>>> <http-headers>
> >>>> <header name="Access-Control-Allow-Origin" value="*" /> 
> >>>> </http-headers>
> >>>>
> >>>> <paths>
> >>>> <basedir>/usr/share/icecast2</basedir>
> >>>> <logdir>/var/log/icecast2</logdir>
> >>>> <webroot>/usr/share/icecast2/web</webroot>
> >>>> <adminroot>/usr/share/icecast2/admin</adminroot>
> >>>> <alias source="/" destination="/status.xsl"/>
> >>>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
> >>>> certificate>
> >>>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
> >>>> key>
> >>>> </paths>
> >>>>
> >>>> The bundle.pem file contains the privkey.pem and fullchain.pem 
> >>>> files of the dehydrated (let's encrypt) certificates, in this 
> >>>> order.
> >>>>
> >>>>
> >>>> ices2 config file:
> >>>>
> >>>> <instance>
> >>>> <port>8443</port>
> >>>> </instance>
> >>>>
> >>>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
> >>>>
> >>>>
> >>>> I am thankful for any help!
> >>>> _______________________________________________
> >>>> Icecast mailing list
> >>>> Icecast at xiph.org
> >>>> http://lists.xiph.org/mailman/listinfo/icecast
> >>> _______________________________________________
> >>> Icecast mailing list
> >>> Icecast at xiph.org
> >>> http://lists.xiph.org/mailman/listinfo/icecast
> >>
> >> _______________________________________________
> >> Icecast mailing list
> >> Icecast at xiph.org
> >> http://lists.xiph.org/mailman/listinfo/icecast
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast

-- 
Das School Community System
https://pc-factory.at/school


From jordan at coolmic.net  Tue Jan  5 17:07:15 2021
From: jordan at coolmic.net (Jordan Erickson)
Date: Tue, 5 Jan 2021 09:07:15 -0800
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <000601d6e345$3b07bde0$b11739a0$@gmx.net>
References: <20210104180050.GA29211@pc-factory.at>
 <1173302304.17505801.1609787696333.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <000601d6e345$3b07bde0$b11739a0$@gmx.net>
Message-ID: <f551dcc4-0090-8668-e6e2-c23ba50d99ad@coolmic.net>

Hello,

FYI, Icecast-kh is not developed, maintained or supported by the 
official Icecast team.


Cheers,
Jordan


On 1/5/21 1:29 AM, hgalt wrote:
> Hello Wangr,
> I am not using icecast 2.4.99.x but I use 2.4.0-kh15 64-bit for windows. It is also a future 2.5 release.
> 
> I figured out something strange with https.
> I have configured port 8044 and 8043 for https. Port 8043 is not working at all, but at port 8044 htpps is working fine for streaming and connection.
> I like that, because everything is on the same port.
> 
> But if do not specify the ssl port, https is not functional. It must be also a different port then the normal port. If I try to use the normal port for ssl too, it is also not working.
> 
> I hope it will help you,
> Hans-Georg Althoff
> 
> -----Urspr?ngliche Nachricht-----
> Von: Icecast [mailto:icecast-bounces at xiph.org] Im Auftrag von Norbert Deleutre
> Gesendet: Montag, 4. Januar 2021 20:15
> An: Icecast streaming server user discussions
> Betreff: Re: [Icecast] Icecast and HTTPS
> 
> I had made the same resquest in septembre 2020.
> And my conclusion is that icecast doesn?t Work with ssl-
> 
> ?-
> N.D
> LMGC
> 
> 
>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
>>
>> ?Hello to all!
>>
>> I have tried for days now to use icecast2 (version 2.4.99.2) with
>> HTTPS. Been through so many manuals and howtos, but nothing works.
>>
>> I have used the Debian version, as well as compiled from source.
>>
>> Ports 8000 and 8443 are open on the firewall.
>>
>>
>> Here is some relevant info:
>>
>> /etc/icecast2/icecast.xml:
>>
>> <listen-socket>
>> <port>8000</port>
>> </listen-socket>
>> <listen-socket>
>> <port>8443</port>
>> <ssl>1</ssl>
>> </listen-socket>
>>
>> <http-headers>
>> <header name="Access-Control-Allow-Origin" value="*" />
>> </http-headers>
>>
>> <paths>
>> <basedir>/usr/share/icecast2</basedir>
>> <logdir>/var/log/icecast2</logdir>
>> <webroot>/usr/share/icecast2/web</webroot>
>> <adminroot>/usr/share/icecast2/admin</adminroot>
>> <alias source="/" destination="/status.xsl"/>
>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-certificate>
>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-key>
>> </paths>
>>
>> The bundle.pem file contains the privkey.pem and fullchain.pem files
>> of the dehydrated (let's encrypt) certificates, in this order.
>>
>>
>> ices2 config file:
>>
>> <instance>
>> <port>8443</port>
>> </instance>
>>
>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
>>
>>
>> I am thankful for any help!
>> _______________________________________________
>> Icecast mailing list
>> Icecast at xiph.org
>> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
> 
> 
> --
> Diese E-Mail wurde von Avast Antivirus-Software auf Viren gepr?ft.
> https://www.avast.com/antivirus
> 
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
> 


From zer0___ at hotmail.com  Tue Jan  5 20:42:33 2021
From: zer0___ at hotmail.com (_zer0_ gravity)
Date: Tue, 5 Jan 2021 20:42:33 +0000
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <20210105151411.GA12225@pc-factory.at>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <20210105151411.GA12225@pc-factory.at>
Message-ID: <AM4PR0401MB2290D469EF3FDBB68FB2C467CDD10@AM4PR0401MB2290.eurprd04.prod.outlook.com>

That is also the reason I did it.
You can even use port 80 and 443 if those are not in use on the server.
Only thing to do this is start icecast2 as root user and group in /etc/init.d/icecast2 or /etc/default/icecast2 and use the <changeowner> section in icecast2.xml:

    <security>
        <chroot>0</chroot>
        <changeowner>
            <user>icecast2</user>
            <group>icecast</group>
        </changeowner>
    </security>

Glad I could help to make it work.

Paul
-----Oorspronkelijk bericht-----
Van: Icecast <icecast-bounces at xiph.org> Namens Wang
Verzonden: Tuesday, 5 January 2021 16:14
Aan: Icecast streaming server user discussions <icecast at xiph.org>
Onderwerp: Re: [Icecast] Icecast and HTTPS

Thank you all for your answers, especially this one here!

Thank you, Paul, for the many good advices.

I actually got it working! In pretty much the same way you described it. ()

As players I tried with success: mpv, mplayer, vlc, cvlc (Linux).
Also inside an <audio> tag in a https page, it worked!
This was the reason I wanted to use https, because I wanted to embed the stream in an https site; if icecast runs only with http, chromium complains; in Firefox it worked well.

_zer0_ gravity <zer0___ at hotmail.com> schrieb am 04.01.2021 20:56:
> There are some things to consider if you want Icecast to serve https:
> 
> The ssl certificate file needs BOTH the private key AND the chain into one file. The order did not make a difference in my setups.
> The <ssl-private-key> is not needed, only the <ssl-certificate>
> 
> Make sure that the icecast2 user is the owner of the certificate:
> chown icecast2:icecast /usr/share/icecast2/icecast.pem
> 
> Make sure NOT to put it in the "web" directory, the pem file should NOT be publicly accessible.
> I have used both /etc/icecast2/ and /usr/share/icecast2/ directories successfully.
> 
> I am using letsencrypt and have use a post-hook script so that it only updates after a new certificate has been deployed:
> #!/bin/bash
> /bin/cat /etc/letsencrypt/live/YOURDOMAIN/privkey.pem 
> /etc/letsencrypt/live/ YOURDOMAIN/fullchain.pem > 
> /usr/share/icecast2/icecast.pem && /usr/bin/systemctl restart icecast2
> 
> Make sure you are NOT using the version from the Debian repositories, as they are compiled without SSL support.
> Instead use the repositories described here: 
> https://wiki.xiph.org/Icecast_Server/Installing_latest_version_(offici
> al_Xiph_repositories)
> 
> I also had to add a priority file to make sure apt grabs the right one, as the version number on both repositories is the same, but only the version on the official Xiph repo has SSL support.
> After adding the official xiph repository add a file /etc/apt/preferences.d/icecast with the following:
> 
> Package: icecast2
> Pin: origin "download.opensuse.org"
> Pin-Priority: 999
> 
> Then do a reinstall with:
> 
> apt update
> apt reinstall icecast2
> 
> This are the relevant parts of my icecast2.xml:
> 
>     <listen-socket>
>         <port>8443</port>
>         <ssl>1</ssl>
>     </listen-socket>
> 
>     <ssl-certificate>/usr/share/icecast2/icecast.pem</ssl-certificate>
> 
> Of course restart icecast2 after updating the ssl-certificate as it is only read during startup, that is also why I do a restart (and not a reload) in the certbot post-hook:
> Systemctl restart icecast2
> Also close and reopen your browser to test so that you are sure the certificate is not being cached locally.
> 
> Worked for me with Debian 9 and 10.
> 
> Regards, Paul
> 
> 
> -----Oorspronkelijk bericht-----
> Van: Icecast <icecast-bounces at xiph.org> Namens Marvin Scholz
> Verzonden: Monday, 4 January 2021 20:59
> Aan: Icecast streaming server user discussions <icecast at xiph.org>
> Onderwerp: Re: [Icecast] Icecast and HTTPS
> 
> Icecast does support TLS and nearly all modern players do support streams over HTTPS too.
> 
> On 4 Jan 2021, at 20:56, Norbert Deleutre wrote:
> 
> > With a free player ?  Which one ?
> >
> > ?-
> > N.D
> > LMGC
> >
> >
> >> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
> >>
> >> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
> >> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
> >>
> >>
> >> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
> >>> I had made the same resquest in septembre 2020.
> >>> And my conclusion is that icecast doesn?t Work with ssl-
> >>>
> >>> ?-
> >>> N.D
> >>> LMGC
> >>>
> >>>
> >>>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
> >>>>
> >>>> ?Hello to all!
> >>>>
> >>>> I have tried for days now to use icecast2 (version 2.4.99.2) with 
> >>>> HTTPS. Been through so many manuals and howtos, but nothing works.
> >>>>
> >>>> I have used the Debian version, as well as compiled from source.
> >>>>
> >>>> Ports 8000 and 8443 are open on the firewall.
> >>>>
> >>>>
> >>>> Here is some relevant info:
> >>>>
> >>>> /etc/icecast2/icecast.xml:
> >>>>
> >>>> <listen-socket>
> >>>> <port>8000</port>
> >>>> </listen-socket>
> >>>> <listen-socket>
> >>>> <port>8443</port>
> >>>> <ssl>1</ssl>
> >>>> </listen-socket>
> >>>>
> >>>> <http-headers>
> >>>> <header name="Access-Control-Allow-Origin" value="*" /> 
> >>>> </http-headers>
> >>>>
> >>>> <paths>
> >>>> <basedir>/usr/share/icecast2</basedir>
> >>>> <logdir>/var/log/icecast2</logdir>
> >>>> <webroot>/usr/share/icecast2/web</webroot>
> >>>> <adminroot>/usr/share/icecast2/admin</adminroot>
> >>>> <alias source="/" destination="/status.xsl"/>
> >>>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
> >>>> certificate>
> >>>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
> >>>> key>
> >>>> </paths>
> >>>>
> >>>> The bundle.pem file contains the privkey.pem and fullchain.pem 
> >>>> files of the dehydrated (let's encrypt) certificates, in this 
> >>>> order.
> >>>>
> >>>>
> >>>> ices2 config file:
> >>>>
> >>>> <instance>
> >>>> <port>8443</port>
> >>>> </instance>
> >>>>
> >>>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
> >>>>
> >>>>
> >>>> I am thankful for any help!
> >>>> _______________________________________________
> >>>> Icecast mailing list
> >>>> Icecast at xiph.org
> >>>> http://lists.xiph.org/mailman/listinfo/icecast
> >>> _______________________________________________
> >>> Icecast mailing list
> >>> Icecast at xiph.org
> >>> http://lists.xiph.org/mailman/listinfo/icecast
> >>
> >> _______________________________________________
> >> Icecast mailing list
> >> Icecast at xiph.org
> >> http://lists.xiph.org/mailman/listinfo/icecast
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast

--
Das School Community System
https://pc-factory.at/school
_______________________________________________
Icecast mailing list
Icecast at xiph.org
http://lists.xiph.org/mailman/listinfo/icecast

From hick.icecast at gink.org  Tue Jan  5 22:23:43 2021
From: hick.icecast at gink.org (gARetH baBB)
Date: Tue, 5 Jan 2021 22:23:43 +0000 (GMT)
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
Message-ID: <bf4743bc-5c71-e16-73f-46897151394@gink.org>

On Mon, 4 Jan 2021, _zer0_ gravity wrote:

> /etc/letsencrypt/live/YOURDOMAIN/privkey.pem /etc/letsencrypt/live/ 
> YOURDOMAIN/fullchain.pem > /usr/share/icecast2/icecast.pem && 
> /usr/bin/systemctl restart icecast2

I just wish they'd get on with a 2.5 release so we don't have to do a 
restart of icecast 2.4 - the alternatives are using -kh or the dev 2.5.

Not thinking that people might need to replace certificates without doing 
a full server restart was braindead to begin with.

As it is, I'm forced to arrange a <silly time> for a restart with a new 
cert.

> Make sure you are NOT using the version from the Debian repositories, as 
> they are compiled without SSL support. Instead use the repositories 

That's not the full story, backports has 2.4.4 with SSL.


From jordan at coolmic.net  Wed Jan  6 00:17:02 2021
From: jordan at coolmic.net (Jordan Erickson)
Date: Tue, 5 Jan 2021 16:17:02 -0800
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <bf4743bc-5c71-e16-73f-46897151394@gink.org>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <bf4743bc-5c71-e16-73f-46897151394@gink.org>
Message-ID: <c6fdc80f-e0d2-e318-6a9b-ef0128f68119@coolmic.net>


On 1/5/21 2:23 PM, gARetH baBB wrote:
> On Mon, 4 Jan 2021, _zer0_ gravity wrote:
> I just wish they'd get on with a 2.5 release

As with all community led open source projects, you are more than 
welcome to join the fun and work with us to help achieve that goal ;)

Playing the 'us and them' card doesn't really make sense in the F/OSS 
ecosystem. It's all 'us'. Here's to a productive 2021!


Cheers,
Jordan Erickson


From Wang at pc-factory.at  Wed Jan  6 12:59:55 2021
From: Wang at pc-factory.at (Wang)
Date: Wed, 6 Jan 2021 13:59:55 +0100
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <AM4PR0401MB2290D469EF3FDBB68FB2C467CDD10@AM4PR0401MB2290.eurprd04.prod.outlook.com>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <20210105151411.GA12225@pc-factory.at>
 <AM4PR0401MB2290D469EF3FDBB68FB2C467CDD10@AM4PR0401MB2290.eurprd04.prod.outlook.com>
Message-ID: <20210106125955.GA8565@pc-factory.at>

Right now I have the server running on port 8000 (http) and port 8443
(https). Is it possible to have it running only on port 8000, but with
https? I tried, but it did not work.

> That is also the reason I did it.
> You can even use port 80 and 443 if those are not in use on the server.
> Only thing to do this is start icecast2 as root user and group in /etc/init.d/icecast2 or /etc/default/icecast2 and use the <changeowner> section in icecast2.xml:
> 
>     <security>
>         <chroot>0</chroot>
>         <changeowner>
>             <user>icecast2</user>
>             <group>icecast</group>
>         </changeowner>
>     </security>
> 
> Glad I could help to make it work.
> 
> Paul
> -----Oorspronkelijk bericht-----
> Van: Icecast <icecast-bounces at xiph.org> Namens Wang
> Verzonden: Tuesday, 5 January 2021 16:14
> Aan: Icecast streaming server user discussions <icecast at xiph.org>
> Onderwerp: Re: [Icecast] Icecast and HTTPS
> 
> Thank you all for your answers, especially this one here!
> 
> Thank you, Paul, for the many good advices.
> 
> I actually got it working! In pretty much the same way you described it. ()
> 
> As players I tried with success: mpv, mplayer, vlc, cvlc (Linux).
> Also inside an <audio> tag in a https page, it worked!
> This was the reason I wanted to use https, because I wanted to embed the stream in an https site; if icecast runs only with http, chromium complains; in Firefox it worked well.
> 
> _zer0_ gravity <zer0___ at hotmail.com> schrieb am 04.01.2021 20:56:
> > There are some things to consider if you want Icecast to serve https:
> > 
> > The ssl certificate file needs BOTH the private key AND the chain into one file. The order did not make a difference in my setups.
> > The <ssl-private-key> is not needed, only the <ssl-certificate>
> > 
> > Make sure that the icecast2 user is the owner of the certificate:
> > chown icecast2:icecast /usr/share/icecast2/icecast.pem
> > 
> > Make sure NOT to put it in the "web" directory, the pem file should NOT be publicly accessible.
> > I have used both /etc/icecast2/ and /usr/share/icecast2/ directories successfully.
> > 
> > I am using letsencrypt and have use a post-hook script so that it only updates after a new certificate has been deployed:
> > #!/bin/bash
> > /bin/cat /etc/letsencrypt/live/YOURDOMAIN/privkey.pem 
> > /etc/letsencrypt/live/ YOURDOMAIN/fullchain.pem > 
> > /usr/share/icecast2/icecast.pem && /usr/bin/systemctl restart icecast2
> > 
> > Make sure you are NOT using the version from the Debian repositories, as they are compiled without SSL support.
> > Instead use the repositories described here: 
> > https://wiki.xiph.org/Icecast_Server/Installing_latest_version_(offici
> > al_Xiph_repositories)
> > 
> > I also had to add a priority file to make sure apt grabs the right one, as the version number on both repositories is the same, but only the version on the official Xiph repo has SSL support.
> > After adding the official xiph repository add a file /etc/apt/preferences.d/icecast with the following:
> > 
> > Package: icecast2
> > Pin: origin "download.opensuse.org"
> > Pin-Priority: 999
> > 
> > Then do a reinstall with:
> > 
> > apt update
> > apt reinstall icecast2
> > 
> > This are the relevant parts of my icecast2.xml:
> > 
> >     <listen-socket>
> >         <port>8443</port>
> >         <ssl>1</ssl>
> >     </listen-socket>
> > 
> >     <ssl-certificate>/usr/share/icecast2/icecast.pem</ssl-certificate>
> > 
> > Of course restart icecast2 after updating the ssl-certificate as it is only read during startup, that is also why I do a restart (and not a reload) in the certbot post-hook:
> > Systemctl restart icecast2
> > Also close and reopen your browser to test so that you are sure the certificate is not being cached locally.
> > 
> > Worked for me with Debian 9 and 10.
> > 
> > Regards, Paul
> > 
> > 
> > -----Oorspronkelijk bericht-----
> > Van: Icecast <icecast-bounces at xiph.org> Namens Marvin Scholz
> > Verzonden: Monday, 4 January 2021 20:59
> > Aan: Icecast streaming server user discussions <icecast at xiph.org>
> > Onderwerp: Re: [Icecast] Icecast and HTTPS
> > 
> > Icecast does support TLS and nearly all modern players do support streams over HTTPS too.
> > 
> > On 4 Jan 2021, at 20:56, Norbert Deleutre wrote:
> > 
> > > With a free player ?  Which one ?
> > >
> > > ?-
> > > N.D
> > > LMGC
> > >
> > >
> > >> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
> > >>
> > >> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from an
> > >> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
> > >>
> > >>
> > >> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
> > >>> I had made the same resquest in septembre 2020.
> > >>> And my conclusion is that icecast doesn?t Work with ssl-
> > >>>
> > >>> ?-
> > >>> N.D
> > >>> LMGC
> > >>>
> > >>>
> > >>>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
> > >>>>
> > >>>> ?Hello to all!
> > >>>>
> > >>>> I have tried for days now to use icecast2 (version 2.4.99.2) with 
> > >>>> HTTPS. Been through so many manuals and howtos, but nothing works.
> > >>>>
> > >>>> I have used the Debian version, as well as compiled from source.
> > >>>>
> > >>>> Ports 8000 and 8443 are open on the firewall.
> > >>>>
> > >>>>
> > >>>> Here is some relevant info:
> > >>>>
> > >>>> /etc/icecast2/icecast.xml:
> > >>>>
> > >>>> <listen-socket>
> > >>>> <port>8000</port>
> > >>>> </listen-socket>
> > >>>> <listen-socket>
> > >>>> <port>8443</port>
> > >>>> <ssl>1</ssl>
> > >>>> </listen-socket>
> > >>>>
> > >>>> <http-headers>
> > >>>> <header name="Access-Control-Allow-Origin" value="*" /> 
> > >>>> </http-headers>
> > >>>>
> > >>>> <paths>
> > >>>> <basedir>/usr/share/icecast2</basedir>
> > >>>> <logdir>/var/log/icecast2</logdir>
> > >>>> <webroot>/usr/share/icecast2/web</webroot>
> > >>>> <adminroot>/usr/share/icecast2/admin</adminroot>
> > >>>> <alias source="/" destination="/status.xsl"/>
> > >>>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
> > >>>> certificate>
> > >>>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-private-
> > >>>> key>
> > >>>> </paths>
> > >>>>
> > >>>> The bundle.pem file contains the privkey.pem and fullchain.pem 
> > >>>> files of the dehydrated (let's encrypt) certificates, in this 
> > >>>> order.
> > >>>>
> > >>>>
> > >>>> ices2 config file:
> > >>>>
> > >>>> <instance>
> > >>>> <port>8443</port>
> > >>>> </instance>
> > >>>>
> > >>>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
> > >>>>
> > >>>>
> > >>>> I am thankful for any help!
> > >>>> _______________________________________________
> > >>>> Icecast mailing list
> > >>>> Icecast at xiph.org
> > >>>> http://lists.xiph.org/mailman/listinfo/icecast
> > >>> _______________________________________________
> > >>> Icecast mailing list
> > >>> Icecast at xiph.org
> > >>> http://lists.xiph.org/mailman/listinfo/icecast
> > >>
> > >> _______________________________________________
> > >> Icecast mailing list
> > >> Icecast at xiph.org
> > >> http://lists.xiph.org/mailman/listinfo/icecast
> > > _______________________________________________
> > > Icecast mailing list
> > > Icecast at xiph.org
> > > http://lists.xiph.org/mailman/listinfo/icecast
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> 
> --
> Das School Community System
> https://pc-factory.at/school
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast

-- 
Das School Community System
https://pc-factory.at/school


From lion at lion.leolix.org  Wed Jan  6 18:33:52 2021
From: lion at lion.leolix.org (Philipp Schafft)
Date: Wed, 06 Jan 2021 18:33:52 +0000
Subject: [Icecast] Release of libshout 2.4.5
Message-ID: <1609958032.24750.7.camel@lion.leolix.org>

Good morning,

we're happy to announce the release of libshout 2.4.5. The new version
includes several fixes as well as improvements.

Major changes:
      * Improved shout.h for reading, and understanding.
      * Marked dumpfile support as obsolete (as
        SHOUT_PROTOCOL_XAUDIOCAST already is).
      * Added Support for setting the content language.
      * Avoid the use of obsolete functions (#2317).
      * Several small fixes for non-blocking mode (#2321, #2315).
      * Corrected detection of libogg (mostly for windows targets).
      * Now accept TLS mode ?auto? when build without TLS support.
      * Added new tool shout(1).

You can find our news entry at:
        https://icecast.org/news/libshout-release-2_4_5/

Downloads can be found at:
        https://icecast.org/download/#bindings


With best regards,

-- 
Philipp.
 (Rah of PH2)


From lion at lion.leolix.org  Wed Jan  6 18:44:30 2021
From: lion at lion.leolix.org (Philipp Schafft)
Date: Wed, 06 Jan 2021 18:44:30 +0000
Subject: [Icecast] Initial Release of libigloo, version 0.9.0
Message-ID: <1609958670.24750.14.camel@lion.leolix.org>

Good morning,

we're pleased to announce the first release of libigloo, version 0.9.0.

libigloo is a generic C framework that will replace the old common/
framework used by our current software. It will provide a more uniform
and modern way of handling common tasks.

I would like to kindly ask all downstream maintainers to have a look at
it, as future versions of our software might start to depend on it
within the next few releases. (This does not apply to Icecast 2.4.x
releases.)

You can find our news entry at:
        https://icecast.org/news/libigloo-release-0_9_0/

Downloads can be found at:
        https://icecast.org/download/#bindings


With best regards,

-- 
Philipp.
 (Rah of PH2)


From zer0___ at hotmail.com  Thu Jan  7 15:56:16 2021
From: zer0___ at hotmail.com (_zer0_ gravity)
Date: Thu, 7 Jan 2021 15:56:16 +0000
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <20210106125955.GA8565@pc-factory.at>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <20210105151411.GA12225@pc-factory.at>
 <AM4PR0401MB2290D469EF3FDBB68FB2C467CDD10@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <20210106125955.GA8565@pc-factory.at>
Message-ID: <AM4PR0401MB2290CFF2B442A8C7D7EF960DCDAF0@AM4PR0401MB2290.eurprd04.prod.outlook.com>

That should be easy, just use only one <listen-socket> section with ssl enabled:

    <listen-socket>
        <port>8000</port>
        <ssl>1</ssl>
    </listen-socket>

Did you restart (and not only reload) icecast ?

Paul

-----Oorspronkelijk bericht-----
Van: Icecast <icecast-bounces at xiph.org> Namens Wang
Verzonden: Wednesday, 6 January 2021 14:00
Aan: Icecast streaming server user discussions <icecast at xiph.org>
Onderwerp: Re: [Icecast] Icecast and HTTPS

Right now I have the server running on port 8000 (http) and port 8443 (https). Is it possible to have it running only on port 8000, but with https? I tried, but it did not work.

> That is also the reason I did it.
> You can even use port 80 and 443 if those are not in use on the server.
> Only thing to do this is start icecast2 as root user and group in /etc/init.d/icecast2 or /etc/default/icecast2 and use the <changeowner> section in icecast2.xml:
> 
>     <security>
>         <chroot>0</chroot>
>         <changeowner>
>             <user>icecast2</user>
>             <group>icecast</group>
>         </changeowner>
>     </security>
> 
> Glad I could help to make it work.
> 
> Paul
> -----Oorspronkelijk bericht-----
> Van: Icecast <icecast-bounces at xiph.org> Namens Wang
> Verzonden: Tuesday, 5 January 2021 16:14
> Aan: Icecast streaming server user discussions <icecast at xiph.org>
> Onderwerp: Re: [Icecast] Icecast and HTTPS
> 
> Thank you all for your answers, especially this one here!
> 
> Thank you, Paul, for the many good advices.
> 
> I actually got it working! In pretty much the same way you described 
> it. ()
> 
> As players I tried with success: mpv, mplayer, vlc, cvlc (Linux).
> Also inside an <audio> tag in a https page, it worked!
> This was the reason I wanted to use https, because I wanted to embed the stream in an https site; if icecast runs only with http, chromium complains; in Firefox it worked well.
> 
> _zer0_ gravity <zer0___ at hotmail.com> schrieb am 04.01.2021 20:56:
> > There are some things to consider if you want Icecast to serve https:
> > 
> > The ssl certificate file needs BOTH the private key AND the chain into one file. The order did not make a difference in my setups.
> > The <ssl-private-key> is not needed, only the <ssl-certificate>
> > 
> > Make sure that the icecast2 user is the owner of the certificate:
> > chown icecast2:icecast /usr/share/icecast2/icecast.pem
> > 
> > Make sure NOT to put it in the "web" directory, the pem file should NOT be publicly accessible.
> > I have used both /etc/icecast2/ and /usr/share/icecast2/ directories successfully.
> > 
> > I am using letsencrypt and have use a post-hook script so that it only updates after a new certificate has been deployed:
> > #!/bin/bash
> > /bin/cat /etc/letsencrypt/live/YOURDOMAIN/privkey.pem
> > /etc/letsencrypt/live/ YOURDOMAIN/fullchain.pem > 
> > /usr/share/icecast2/icecast.pem && /usr/bin/systemctl restart 
> > icecast2
> > 
> > Make sure you are NOT using the version from the Debian repositories, as they are compiled without SSL support.
> > Instead use the repositories described here: 
> > https://wiki.xiph.org/Icecast_Server/Installing_latest_version_(offi
> > ci
> > al_Xiph_repositories)
> > 
> > I also had to add a priority file to make sure apt grabs the right one, as the version number on both repositories is the same, but only the version on the official Xiph repo has SSL support.
> > After adding the official xiph repository add a file /etc/apt/preferences.d/icecast with the following:
> > 
> > Package: icecast2
> > Pin: origin "download.opensuse.org"
> > Pin-Priority: 999
> > 
> > Then do a reinstall with:
> > 
> > apt update
> > apt reinstall icecast2
> > 
> > This are the relevant parts of my icecast2.xml:
> > 
> >     <listen-socket>
> >         <port>8443</port>
> >         <ssl>1</ssl>
> >     </listen-socket>
> > 
> >     
> > <ssl-certificate>/usr/share/icecast2/icecast.pem</ssl-certificate>
> > 
> > Of course restart icecast2 after updating the ssl-certificate as it is only read during startup, that is also why I do a restart (and not a reload) in the certbot post-hook:
> > Systemctl restart icecast2
> > Also close and reopen your browser to test so that you are sure the certificate is not being cached locally.
> > 
> > Worked for me with Debian 9 and 10.
> > 
> > Regards, Paul
> > 
> > 
> > -----Oorspronkelijk bericht-----
> > Van: Icecast <icecast-bounces at xiph.org> Namens Marvin Scholz
> > Verzonden: Monday, 4 January 2021 20:59
> > Aan: Icecast streaming server user discussions <icecast at xiph.org>
> > Onderwerp: Re: [Icecast] Icecast and HTTPS
> > 
> > Icecast does support TLS and nearly all modern players do support streams over HTTPS too.
> > 
> > On 4 Jan 2021, at 20:56, Norbert Deleutre wrote:
> > 
> > > With a free player ?  Which one ?
> > >
> > > ?-
> > > N.D
> > > LMGC
> > >
> > >
> > >> Le 4 janv. 2021 ? 20:34, John McHarry <jmcharry at gmx.net> a ?crit :
> > >>
> > >> ?It does. https://audio-mp3.ibiblio.org/whqr_hd1 is served from 
> > >> an
> > >> icecast2 server. Check http://audio-mp3.ibiblio.org:8000
> > >>
> > >>
> > >> On Mon, 2021-01-04 at 20:14 +0100, Norbert Deleutre wrote:
> > >>> I had made the same resquest in septembre 2020.
> > >>> And my conclusion is that icecast doesn?t Work with ssl-
> > >>>
> > >>> ?-
> > >>> N.D
> > >>> LMGC
> > >>>
> > >>>
> > >>>> Le 4 janv. 2021 ? 19:06, Wangr <Wang at pc-factory.at> a ?crit :
> > >>>>
> > >>>> ?Hello to all!
> > >>>>
> > >>>> I have tried for days now to use icecast2 (version 2.4.99.2) 
> > >>>> with HTTPS. Been through so many manuals and howtos, but nothing works.
> > >>>>
> > >>>> I have used the Debian version, as well as compiled from source.
> > >>>>
> > >>>> Ports 8000 and 8443 are open on the firewall.
> > >>>>
> > >>>>
> > >>>> Here is some relevant info:
> > >>>>
> > >>>> /etc/icecast2/icecast.xml:
> > >>>>
> > >>>> <listen-socket>
> > >>>> <port>8000</port>
> > >>>> </listen-socket>
> > >>>> <listen-socket>
> > >>>> <port>8443</port>
> > >>>> <ssl>1</ssl>
> > >>>> </listen-socket>
> > >>>>
> > >>>> <http-headers>
> > >>>> <header name="Access-Control-Allow-Origin" value="*" /> 
> > >>>> </http-headers>
> > >>>>
> > >>>> <paths>
> > >>>> <basedir>/usr/share/icecast2</basedir>
> > >>>> <logdir>/var/log/icecast2</logdir>
> > >>>> <webroot>/usr/share/icecast2/web</webroot>
> > >>>> <adminroot>/usr/share/icecast2/admin</adminroot>
> > >>>> <alias source="/" destination="/status.xsl"/>
> > >>>> <ssl-certificate>/usr/share/icecast2/web/bundle.pem</ssl-
> > >>>> certificate>
> > >>>> <ssl-private-key>/usr/share/icecast2/web/bundle.pem</ssl-privat
> > >>>> e-
> > >>>> key>
> > >>>> </paths>
> > >>>>
> > >>>> The bundle.pem file contains the privkey.pem and fullchain.pem 
> > >>>> files of the dehydrated (let's encrypt) certificates, in this 
> > >>>> order.
> > >>>>
> > >>>>
> > >>>> ices2 config file:
> > >>>>
> > >>>> <instance>
> > >>>> <port>8443</port>
> > >>>> </instance>
> > >>>>
> > >>>> with <port>8000</port> (HTTP) it works, not with 8443 (HTTPS).
> > >>>>
> > >>>>
> > >>>> I am thankful for any help!
> > >>>> _______________________________________________
> > >>>> Icecast mailing list
> > >>>> Icecast at xiph.org
> > >>>> http://lists.xiph.org/mailman/listinfo/icecast
> > >>> _______________________________________________
> > >>> Icecast mailing list
> > >>> Icecast at xiph.org
> > >>> http://lists.xiph.org/mailman/listinfo/icecast
> > >>
> > >> _______________________________________________
> > >> Icecast mailing list
> > >> Icecast at xiph.org
> > >> http://lists.xiph.org/mailman/listinfo/icecast
> > > _______________________________________________
> > > Icecast mailing list
> > > Icecast at xiph.org
> > > http://lists.xiph.org/mailman/listinfo/icecast
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> 
> --
> Das School Community System
> https://pc-factory.at/school
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast

--
Das School Community System
https://pc-factory.at/school
_______________________________________________
Icecast mailing list
Icecast at xiph.org
http://lists.xiph.org/mailman/listinfo/icecast

From Wang at pc-factory.at  Fri Jan  8 13:31:16 2021
From: Wang at pc-factory.at (Wang)
Date: Fri, 8 Jan 2021 14:31:16 +0100
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <AM4PR0401MB2290CFF2B442A8C7D7EF960DCDAF0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
References: <2a0808c3d8d5c3da9bd5af4dacb8efa607021e99.camel@gmx.net>
 <1388895743.17607287.1609790165158.JavaMail.zimbra@zpstore2.infra.umontpellier.fr>
 <59A65082-8419-46DF-885F-6FE4AE24DBF0@gmail.com>
 <AM4PR0401MB2290157A1D78D724E6FC82FBCDD20@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <20210105151411.GA12225@pc-factory.at>
 <AM4PR0401MB2290D469EF3FDBB68FB2C467CDD10@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <20210106125955.GA8565@pc-factory.at>
 <AM4PR0401MB2290CFF2B442A8C7D7EF960DCDAF0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
Message-ID: <20210108133116.GA8639@pc-factory.at>

> That should be easy, just use only one <listen-socket> section with ssl enabled:
> 
> <listen-socket>
>   <port>8000</port>
>   <ssl>1</ssl>
> </listen-socket>

Thought so too. But in this case port 8000 does not work.

With this:

<listen-socket><port>8000</port><ssl>1</ssl></listen-socket>
<listen-socket><port>8443</port><ssl>1</ssl></listen-socket>

neither port 8000 nor port 8443 work.

What might I be missing here?

> Did you restart (and not only reload) icecast ?

Yes, I did.

> Paul


From zer0___ at hotmail.com  Fri Jan  8 13:48:48 2021
From: zer0___ at hotmail.com (zer0___ at hotmail.com)
Date: Fri, 08 Jan 2021 14:48:48 +0100
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <20210108133116.GA8639@pc-factory.at>
Message-ID: <AM4PR0401MB22901C72360DBB44F51833CDCDAE0@AM4PR0401MB2290.eurprd04.prod.outlook.com>

An HTML attachment was scrubbed...
URL: <http://lists.xiph.org/pipermail/icecast/attachments/20210108/0d38e59c/attachment.htm>

From zer0___ at hotmail.com  Sat Jan  9 12:55:21 2021
From: zer0___ at hotmail.com (_zer0_ gravity)
Date: Sat, 9 Jan 2021 12:55:21 +0000
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <AM4PR0401MB22901C72360DBB44F51833CDCDAE0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
References: <20210108133116.GA8639@pc-factory.at>
 <AM4PR0401MB22901C72360DBB44F51833CDCDAE0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
Message-ID: <AM4PR0401MB22907E72696F538CC6159A48CDAD0@AM4PR0401MB2290.eurprd04.prod.outlook.com>

I tested it on a CentOS7 machine and on I actually could use only one listen port with ssl, so there must be something else with your setup.
If you are on CentOS or any other RHEL based os, is selinux enabled or at least in permissive mode ?
Check with ?sestatus?, test with ?setenforce permissive?.

Paul

Van: Icecast <icecast-bounces at xiph.org> Namens zer0___ at hotmail.com
Verzonden: Friday, 8 January 2021 14:49
Aan: Icecast streaming server user discussions <icecast at xiph.org>
Onderwerp: Re: [Icecast] Icecast and HTTPS

I will test this, maybe it must at least have one port with ssl disabled.
You could do a bind for port 8000 on 127.0.0.1
Then functionally you only have port 8443 on public network.
You can also block this port in your firewall.

Paul

Op 8 jan. 2021 14:31 schreef Wang <Wang at pc-factory.at<mailto:Wang at pc-factory.at>>:

> That should be easy, just use only one <listen-socket> section with ssl enabled:
>
> <listen-socket>
>   <port>8000</port>
>   <ssl>1</ssl>
> </listen-socket>

Thought so too. But in this case port 8000 does not work.

With this:

<listen-socket><port>8000</port><ssl>1</ssl></listen-socket>
<listen-socket><port>8443</port><ssl>1</ssl></listen-socket>

neither port 8000 nor port 8443 work.

What might I be missing here?

> Did you restart (and not only reload) icecast ?

Yes, I did.

> Paul
_______________________________________________
Icecast mailing list
Icecast at xiph.org<mailto:Icecast at xiph.org>
http://lists.xiph.org/mailman/listinfo/icecast

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xiph.org/pipermail/icecast/attachments/20210109/7543dc5c/attachment.htm>

From Wang at pc-factory.at  Sun Jan 10 10:28:17 2021
From: Wang at pc-factory.at (Wang)
Date: Sun, 10 Jan 2021 11:28:17 +0100
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <AM4PR0401MB22907E72696F538CC6159A48CDAD0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
References: <20210108133116.GA8639@pc-factory.at>
 <AM4PR0401MB22901C72360DBB44F51833CDCDAE0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <AM4PR0401MB22907E72696F538CC6159A48CDAD0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
Message-ID: <20210110102817.GA1445@pc-factory.at>

Hello Paul,

I am running Debian 10.

I also tested:
port 8000 without ssl, but
ports 8443 8444 8445 8846 with ssl (all of them at the same time).
It worked.

It seems there has to be one non-ssl port running ...

> I tested it on a CentOS7 machine and on I actually could use only one
> listen port with ssl, so there must be something else with your setup.
>
> If you are on CentOS or any other RHEL based os, is selinux enabled or at
> least in permissive mode ?
>
> Check with ?sestatus?, test with ?setenforce permissive?.
>
> Paul
> 
>> Van: Icecast <icecast-bounces at xiph.org> Namens zer0___ at hotmail.com
>> Verzonden: Friday, 8 January 2021 14:49
>> Aan: Icecast streaming server user discussions <icecast at xiph.org>
>> Onderwerp: Re: [Icecast] Icecast and HTTPS
>> 
>> I will test this, maybe it must at least have one port with ssl disabled.
>>
>> You could do a bind for port 8000 on 127.0.0.1
>>
>> Then functionally you only have port 8443 on public network.
>>
>> You can also block this port in your firewall.
>>
>> Paul


From zer0___ at hotmail.com  Mon Jan 11 10:41:52 2021
From: zer0___ at hotmail.com (_zer0_ gravity)
Date: Mon, 11 Jan 2021 10:41:52 +0000
Subject: [Icecast] Icecast and HTTPS
In-Reply-To: <20210110102817.GA1445@pc-factory.at>
References: <20210108133116.GA8639@pc-factory.at>
 <AM4PR0401MB22901C72360DBB44F51833CDCDAE0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <AM4PR0401MB22907E72696F538CC6159A48CDAD0@AM4PR0401MB2290.eurprd04.prod.outlook.com>
 <20210110102817.GA1445@pc-factory.at>
Message-ID: <AM4PR0401MB2290A424D20B3C54B42687C4CDAB0@AM4PR0401MB2290.eurprd04.prod.outlook.com>

You must be doing something wrong, I tested it with Debian 10 and it works fine with only one port and ssl enabled:

    <!-- You may have multiple <listen-socket> elements -->
    <!-- <listen-socket> -->
        <!-- <port>80</port> -->
        <!-- <bind-address>127.0.0.1</bind-address> -->
        <!-- <shoutcast-mount>/stream</shoutcast-mount> -->
    <!-- </listen-socket> -->

    <listen-socket>
        <port>443</port>
        <ssl>1</ssl>
    </listen-socket>

This is the result:

root at debian10:~# netstat -lnp | grep icecast
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      46841/icecast2
root at debian10:~#
root at debian10:~# openssl s_client -connect xxx.xxxxx.xxx:443
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = xxx.xxxxx.xxx
verify return:1
---
Certificate chain
 0 s:CN = xxx.xxxxx.xxx
   i:C = US, O = Let's Encrypt, CN = R3
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
---



-----Oorspronkelijk bericht-----
Van: Icecast <icecast-bounces at xiph.org> Namens Wang
Verzonden: Sunday, 10 January 2021 11:28
Aan: Icecast streaming server user discussions <icecast at xiph.org>
Onderwerp: Re: [Icecast] Icecast and HTTPS

Hello Paul,

I am running Debian 10.

I also tested:
port 8000 without ssl, but
ports 8443 8444 8445 8846 with ssl (all of them at the same time).
It worked.

It seems there has to be one non-ssl port running ...

> I tested it on a CentOS7 machine and on I actually could use only one 
> listen port with ssl, so there must be something else with your setup.
>
> If you are on CentOS or any other RHEL based os, is selinux enabled or 
> at least in permissive mode ?
>
> Check with ?sestatus?, test with ?setenforce permissive?.
>
> Paul
> 
>> Van: Icecast <icecast-bounces at xiph.org> Namens zer0___ at hotmail.com
>> Verzonden: Friday, 8 January 2021 14:49
>> Aan: Icecast streaming server user discussions <icecast at xiph.org>
>> Onderwerp: Re: [Icecast] Icecast and HTTPS
>> 
>> I will test this, maybe it must at least have one port with ssl disabled.
>>
>> You could do a bind for port 8000 on 127.0.0.1
>>
>> Then functionally you only have port 8443 on public network.
>>
>> You can also block this port in your firewall.
>>
>> Paul
_______________________________________________
Icecast mailing list
Icecast at xiph.org
http://lists.xiph.org/mailman/listinfo/icecast

From latinfo at vcn.bc.ca  Tue Jan 12 07:40:25 2021
From: latinfo at vcn.bc.ca (latinfo at vcn.bc.ca)
Date: Mon, 11 Jan 2021 23:40:25 -0800
Subject: [Icecast] error ices2
Message-ID: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>

Can somebody help with this error? it happens when i run ices-playlist.xml

# /etc/ices2/ices-playlist.xml
/etc/ices2/ices-playlist.xml: line 1: syntax error near unexpected token
`newline'
/etc/ices2/ices-playlist.xml: line 1: `<?xml version="1.0"?>'



From Wang at pc-factory.at  Tue Jan 12 09:21:46 2021
From: Wang at pc-factory.at (Wang)
Date: Tue, 12 Jan 2021 10:21:46 +0100
Subject: [Icecast] error ices2
In-Reply-To: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>
References: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>
Message-ID: <20210112092146.GA2448@pc-factory.at>

I believe it's the quotation marks. Please use only this:

<?xml version="1.0"?>

latinfo at vcn.bc.ca schrieb am 11.01.2021 23:40:
> Can somebody help with this error? it happens when i run ices-playlist.xml
> 
> # /etc/ices2/ices-playlist.xml
> /etc/ices2/ices-playlist.xml: line 1: syntax error near unexpected token
> `newline'
> /etc/ices2/ices-playlist.xml: line 1: `<?xml version="1.0"?>'


From tyctor at post.cz  Tue Jan 12 17:15:24 2021
From: tyctor at post.cz (tyctor)
Date: Tue, 12 Jan 2021 18:15:24 +0100
Subject: [Icecast] proper ssl setup
Message-ID: <aac6eab09b018f0919e5c4fde8b7411244241e78.camel@post.cz>

hi 

i have question about ssl setup
in icecast.xml we have defined two ports
(8000 without ssl and 8001 with ssl)

<listen-socket>
   <port>8000</port>
</listen-socket>
<listen-socket>
   <port>8001</port>
   <ssl>1</ssl>
</listen-socket>

on backend side there is ezstream which streams mp3 recordings to port
8000 (without ssl)

we are using port 8001 (with ssl) from our website, where audio player
use it as src
it is because our site is running on https only, so every link and src
need to go via ssl

we are using icecast builded with ssl from repository 
http://download.opensuse.org/repositories/multimedia:/xiph/xUbuntu_18.04/


is this proper way how should be ssl configured and used on icecast?
i am asking because once in a while icecast stop streaming on port 8001
and need to be restarted to continue

thanks for any hints
tyctor



From latinfo at vcn.bc.ca  Wed Jan 13 03:47:59 2021
From: latinfo at vcn.bc.ca (latinfo at vcn.bc.ca)
Date: Tue, 12 Jan 2021 19:47:59 -0800
Subject: [Icecast] error ices2
In-Reply-To: <20210112092146.GA2448@pc-factory.at>
References: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>
 <20210112092146.GA2448@pc-factory.at>
Message-ID: <6d0606f129d8c48f64b5704c9ce12bc6.squirrel@mail.vcn.bc.ca>

There are not quotations marks in the original!
Thanks to answer.

<?xml version="1.0"?>
<ices>
    <!-- run in background -->
    <background>0</background>
    <!-- where logs, etc go. -->
    <logpath>/var/log/ices</logpath>
    <logfile>ices.log</logfile>
    <!-- 1=error,2=warn,3=info,4=debug -->
    <loglevel>4</loglevel>
    <!-- set this to 1 to log to the console instead of to the file above -->
    <consolelog>0</consolelog>


> I believe it's the quotation marks. Please use only this:
>
> <?xml version="1.0"?>
>
> latinfo at vcn.bc.ca schrieb am 11.01.2021 23:40:
>> Can somebody help with this error? it happens when i run
>> ices-playlist.xml
>>
>> # /etc/ices2/ices-playlist.xml
>> /etc/ices2/ices-playlist.xml: line 1: syntax error near unexpected token
>> `newline'
>> /etc/ices2/ices-playlist.xml: line 1: `<?xml version="1.0"?>'
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
>




From sigfood at dinorama.fr  Wed Jan 13 07:58:35 2021
From: sigfood at dinorama.fr (tTh)
Date: Wed, 13 Jan 2021 08:58:35 +0100
Subject: [Icecast] error ices2
In-Reply-To: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>
References: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>
Message-ID: <6921a294-f842-fb3b-3919-81124a52eeab@dinorama.fr>

On 12/01/2021 08:40, latinfo at vcn.bc.ca wrote:
> Can somebody help with this error? it happens when i run ices-playlist.xml
> 
> # /etc/ices2/ices-playlist.xml
> /etc/ices2/ices-playlist.xml: line 1: syntax error near unexpected token
> `newline'
> /etc/ices2/ices-playlist.xml: line 1: `<?xml version="1.0"?>'

    Don't try to run the XML file !

# /usr/bin/ices2 /etc/ices2/ices-playlist.xml

tTh

-- 
--------------( *  *  *  *  *  *  *  *  *  * * * * * * * * )-------
--------------( https://al.smeuh.org/cgi-bin/express.pritz )-------



From latinfo at vcn.bc.ca  Thu Jan 14 00:50:09 2021
From: latinfo at vcn.bc.ca (latinfo at vcn.bc.ca)
Date: Wed, 13 Jan 2021 16:50:09 -0800
Subject: [Icecast] error ices2
In-Reply-To: <6921a294-f842-fb3b-3919-81124a52eeab@dinorama.fr>
References: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>
 <6921a294-f842-fb3b-3919-81124a52eeab@dinorama.fr>
Message-ID: <1781b7124842b5fe3364204e79c734fe.squirrel@mail.vcn.bc.ca>

Please excuse my ignorance, but how could i make it work with icecast2 in
Debian buster? the error happends after edition of ices-playlist.xml



> On 12/01/2021 08:40, latinfo at vcn.bc.ca wrote:
>> Can somebody help with this error? it happens when i run
>> ices-playlist.xml
>>
>> # /etc/ices2/ices-playlist.xml
>> /etc/ices2/ices-playlist.xml: line 1: syntax error near unexpected token
>> `newline'
>> /etc/ices2/ices-playlist.xml: line 1: `<?xml version="1.0"?>'
>
>     Don't try to run the XML file !
>
> # /usr/bin/ices2 /etc/ices2/ices-playlist.xml
>
> tTh
>
> --
> --------------( *  *  *  *  *  *  *  *  *  * * * * * * * * )-------
> --------------( https://al.smeuh.org/cgi-bin/express.pritz )-------
>
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
>




From jordan at coolmic.net  Thu Jan 14 01:28:08 2021
From: jordan at coolmic.net (Jordan Erickson)
Date: Wed, 13 Jan 2021 17:28:08 -0800
Subject: [Icecast] error ices2
In-Reply-To: <1781b7124842b5fe3364204e79c734fe.squirrel@mail.vcn.bc.ca>
References: <c68c45b3c52b05ee307661773c51692e.squirrel@mail.vcn.bc.ca>
 <6921a294-f842-fb3b-3919-81124a52eeab@dinorama.fr>
 <1781b7124842b5fe3364204e79c734fe.squirrel@mail.vcn.bc.ca>
Message-ID: <207fadf6-1acf-f60d-6ad0-24d67383e586@coolmic.net>

Hi,

Check out the documentation for Ices2 here:

https://icecast.org/ices/docs/ices-2.0.2/

Like tTh said, make sure you run the ices2 binary with the parameter of 
your configuration file, like the following:

# /usr/bin/ices2 /etc/ices2/ices-playlist.xml


Cheers,
Jordan Erickson


On 1/13/21 4:50 PM, latinfo at vcn.bc.ca wrote:
> Please excuse my ignorance, but how could i make it work with icecast2 in
> Debian buster? the error happends after edition of ices-playlist.xml
> 
> 
> 
>> On 12/01/2021 08:40, latinfo at vcn.bc.ca wrote:
>>> Can somebody help with this error? it happens when i run
>>> ices-playlist.xml
>>>
>>> # /etc/ices2/ices-playlist.xml
>>> /etc/ices2/ices-playlist.xml: line 1: syntax error near unexpected token
>>> `newline'
>>> /etc/ices2/ices-playlist.xml: line 1: `<?xml version="1.0"?>'
>>
>>      Don't try to run the XML file !
>>
>> # /usr/bin/ices2 /etc/ices2/ices-playlist.xml
>>
>> tTh
>>
>> --
>> --------------( *  *  *  *  *  *  *  *  *  * * * * * * * * )-------
>> --------------( https://al.smeuh.org/cgi-bin/express.pritz )-------
>>
>> _______________________________________________
>> Icecast mailing list
>> Icecast at xiph.org
>> http://lists.xiph.org/mailman/listinfo/icecast
>>
> 
> 
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
> 


From tyctor at post.cz  Thu Jan 14 13:10:06 2021
From: tyctor at post.cz (tyctor)
Date: Thu, 14 Jan 2021 14:10:06 +0100
Subject: [Icecast] proper ssl setup question
Message-ID: <b0971caddbad53fee3905a1610e2aa1ba768d022.camel@post.cz>

hi 

i have question about ssl setup
in icecast.xml we have defined two ports
(8000 without ssl and 8001 with ssl)

<listen-socket>
   <port>8000</port>
</listen-socket>
<listen-socket>
   <port>8001</port>
   <ssl>1</ssl>
</listen-socket>

on backend side there is ezstream which streams mp3 recordings to port
8000 (without ssl)

we are using port 8001 (with ssl) from our website, where audio player
use it as src
it is because our site is running on https only, so every link and src
need to go via ssl

we are using icecast builded with ssl from repository 
http://download.opensuse.org/repositories/multimedia:/xiph/xUbuntu_18.04/


is this proper way how should be ssl configured and used on icecast?
i am asking because once in a while icecast stop streaming on port 8001
and need to be restarted to continue

thanks for any hints
tyctor



From Wang at pc-factory.at  Thu Jan 14 14:25:27 2021
From: Wang at pc-factory.at (Wang)
Date: Thu, 14 Jan 2021 15:25:27 +0100
Subject: [Icecast] proper ssl setup question
In-Reply-To: <b0971caddbad53fee3905a1610e2aa1ba768d022.camel@post.cz>
References: <b0971caddbad53fee3905a1610e2aa1ba768d022.camel@post.cz>
Message-ID: <20210114142527.GA19859@pc-factory.at>

That should be the right way to do it, yes.
I did it this way and it worked. :-)

Perhaps the reason why the streaming stops is not because
of the server setup, but because of ezstream.
Does the stream also stop on port 8000?

tyctor <tyctor at post.cz> schrieb am 14.01.2021 14:10:
> hi 
> 
> i have question about ssl setup
> in icecast.xml we have defined two ports
> (8000 without ssl and 8001 with ssl)
> 
> <listen-socket>
>    <port>8000</port>
> </listen-socket>
> <listen-socket>
>    <port>8001</port>
>    <ssl>1</ssl>
> </listen-socket>
> 
> on backend side there is ezstream which streams mp3 recordings to port
> 8000 (without ssl)
> 
> we are using port 8001 (with ssl) from our website, where audio player
> use it as src
> it is because our site is running on https only, so every link and src
> need to go via ssl
> 
> we are using icecast builded with ssl from repository 
> http://download.opensuse.org/repositories/multimedia:/xiph/xUbuntu_18.04/
> 
> is this proper way how should be ssl configured and used on icecast?
> i am asking because once in a while icecast stop streaming on port 8001
> and need to be restarted to continue
> 
> thanks for any hints
> tyctor


From tyctor at post.cz  Thu Jan 14 14:51:22 2021
From: tyctor at post.cz (tyctor)
Date: Thu, 14 Jan 2021 15:51:22 +0100
Subject: [Icecast] proper ssl setup question
In-Reply-To: <20210114142527.GA19859@pc-factory.at>
References: <b0971caddbad53fee3905a1610e2aa1ba768d022.camel@post.cz>
 <20210114142527.GA19859@pc-factory.at>
Message-ID: <71cdd61d8c2fa5f8e975690604df56fb527d5837.camel@post.cz>

that's it, on 8000 stream still working
only 8001 is stopped

but good if this is proper setup
problem could be elsewhere
icecast is running inside container
i will try to change this 8001 to other number to see if this will also
happen

thanks for reply

On Thu, 2021-01-14 at 15:25 +0100, Wang wrote:
> That should be the right way to do it, yes.
> I did it this way and it worked. :-)
> 
> Perhaps the reason why the streaming stops is not because
> of the server setup, but because of ezstream.
> Does the stream also stop on port 8000?
> 
> tyctor <tyctor at post.cz> schrieb am 14.01.2021 14:10:
> > hi 
> > 
> > i have question about ssl setup
> > in icecast.xml we have defined two ports
> > (8000 without ssl and 8001 with ssl)
> > 
> > <listen-socket>
> >    <port>8000</port>
> > </listen-socket>
> > <listen-socket>
> >    <port>8001</port>
> >    <ssl>1</ssl>
> > </listen-socket>
> > 
> > on backend side there is ezstream which streams mp3 recordings to
> > port
> > 8000 (without ssl)
> > 
> > we are using port 8001 (with ssl) from our website, where audio
> > player
> > use it as src
> > it is because our site is running on https only, so every link and
> > src
> > need to go via ssl
> > 
> > we are using icecast builded with ssl from repository 
> > http://download.opensuse.org/repositories/multimedia:/xiph/xUbuntu_18.04/
> > 
> > is this proper way how should be ssl configured and used on
> > icecast?
> > i am asking because once in a while icecast stop streaming on port
> > 8001
> > and need to be restarted to continue
> > 
> > thanks for any hints
> > tyctor
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast