<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As of 24 april 2025 sonos deleted older cipher suites and since that date the stream dos not work through sonos any longer.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Testing vertenradio.nl through ssllabs shows no ecdhe chipers at all, most important the required TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is missing, which is loaded by icecast regarding the error log.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Also TLS 1.3 isn't available, not per se necessary but still......</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Icecast 2.4.4 is installed on a windows 2018 server.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Any suggestions are welcome, thx in advance</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Johan</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Icecast <icecast-bounces@xiph.org> on behalf of Brad Isbell <brad@audiopump.co><br>
<b>Sent:</b> Sunday, March 5, 2023 6:29 PM<br>
<b>To:</b> Icecast streaming server user discussions <icecast@xiph.org><br>
<b>Subject:</b> Re: [Icecast] icecast https stream and Sonos</font>
<div> </div>
</div>
<div>
<div dir="ltr">Johan, the Sonos information here is spot on. You are missing the intermediate certs.
<div><br>
</div>
<div>While your stream will work fine in common browsers where the certificates are already available, they won't necessarily work in other places.</div>
<div><br>
</div>
<div>Once you concatenate the right certificates in, DigiCert has an online tool you can use to check that you have it correct: <a href="https://www.digicert.com/help/">https://www.digicert.com/help/</a> If you were on port :443, you could also use <a href="https://www.ssllabs.com/ssltest/">https://www.ssllabs.com/ssltest/</a>.</div>
<div>
<div>
<div dir="ltr" class="x_gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div style="margin-top:2em; border-top:1px solid rgb(85,85,85); width:50%">
<table style="font-size:13px; color:rgb(51,51,51)">
<tbody>
<tr>
<td><img src="https://audiopump.co/img/audiopump-logo-64px.png"></td>
<td><strong>Brad Isbell // AudioPump, Inc.</strong><br>
<a href="mailto:brad@audiopump.co" target="_blank">brad@audiopump.co</a><br>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Sun, Mar 5, 2023 at 2:58 AM Verten Radio <<a href="mailto:verten@xs4all.nl">verten@xs4all.nl</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div class="x_msg6840639004855663982">
<div lang="NL" style="">
<div class="x_m_6840639004855663982WordSection1">
<p class="x_MsoNormal">My icecast https stream (<a href="https://vertenradio.com:8443/stream" target="_blank">https://vertenradio.com:8443/stream</a>) does not work on a Sonos ONE player.</p>
<p class="x_MsoNormal"><u></u> <u></u></p>
<p class="x_MsoNormal">It might have something to do with the ssl handshake.</p>
<p class="x_MsoNormal"><u></u> <u></u></p>
<p class="x_MsoNormal">From the developer page from sonos i found this:</p>
<p class="x_MsoNormal"><u></u> <u></u></p>
<div>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)">Some common reasons for SSL handshake failures include:<u></u><u></u></span></p>
<ul type="disc">
<li class="x_MsoNormal" style="color:rgb(34,34,34); background:white; box-sizing:border-box; margin:1rem">
<strong><span style="font-size:12pt; font-family:Helvetica,sans-serif">Expired certificate</span></strong><span style="font-size:12pt; font-family:Helvetica,sans-serif">: Every certificate has a validity window before it expires. You need to present Sonos with
unexpired certificates.</span><span style="font-size:12pt; font-family:Helvetica,sans-serif"><u></u><u></u></span></li><li class="x_MsoNormal" style="color:rgb(34,34,34); background:white; box-sizing:border-box; margin:1rem">
<strong><span style="font-size:12pt; font-family:Helvetica,sans-serif">DNS name mismatch</span></strong><span style="font-size:12pt; font-family:Helvetica,sans-serif">: Your certificate must match the DNS name used in the Sonos service catalog. If the URL in
the Sonos service catalog is <a href="https://stremingservice.example.com/svc" target="_blank">
https://stremingservice.example.com/svc</a>, then your certificate must have a subjectAltName or a Common Name matching
<a href="http://streamingservice.example.com" target="_blank">streamingservice.example.com</a>. Any mismatches will cause an outage. For example, this may occur if you introduce a Content Delivery Network (CDN) into your setup as this may affect the DNS names
and certificates involved.<u></u><u></u></span></li><li class="x_MsoNormal" style="color:rgb(34,34,34); background:white; box-sizing:border-box; margin:1rem">
<strong><span style="font-size:12pt; font-family:Helvetica,sans-serif">Missing intermediate CA cert</span></strong><span style="font-size:12pt; font-family:Helvetica,sans-serif">: Most certificate authorities do not issue individual server certificates directly
from their root CA certificate. They often use an intermediate CA certificate. Usually, the chain looks like this:<br>
<em><span style="font-family:Helvetica,sans-serif">Root CA certificate -> Intermediate CA certificate -> Your service’s SSL server certificate.</span></em><br>
In these cases, you must configure your SSL server to send Sonos the intermediate CA certificate as well as your SSL server certificate. Without this, Sonos will not be able to validate the full chain and the validation may fail.<u></u><u></u></span></li></ul>
<p style="line-height:18pt; background:white; box-sizing:border-box; margin:1.25rem; font-variant-ligatures:normal; font-variant-caps:normal; text-align:start; text-decoration-style:initial; text-decoration-color:initial; word-spacing:0px">
<span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)">I don’t thinks this is the case, but what could it be?<u></u><u></u></span></p>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)">Any answers?<u></u><u></u></span></p>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)">Glad to hear it,
<u></u><u></u></span></p>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)">Regards,<u></u><u></u></span></p>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)"><u></u> <u></u></span></p>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)">Johan<u></u><u></u></span></p>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)"><u></u> <u></u></span></p>
<p style="line-height:18pt; background:white"><span style="font-size:12pt; font-family:Arial,sans-serif; color:rgb(34,34,34)"><u></u> <u></u></span></p>
</div>
<p class="x_MsoNormal"><u></u> <u></u></p>
<p class="x_MsoNormal"><u></u> <u></u></p>
<p class="x_MsoNormal">Verzonden vanuit <a href="https://go.microsoft.com/fwlink/?LinkId=550986" target="_blank">
Mail</a> voor Windows</p>
<p class="x_MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Icecast mailing list<br>
<a href="mailto:Icecast@xiph.org" target="_blank">Icecast@xiph.org</a><br>
<a href="http://lists.xiph.org/mailman/listinfo/icecast" rel="noreferrer" target="_blank">http://lists.xiph.org/mailman/listinfo/icecast</a><br>
</div>
</blockquote>
</div>
</div>
</body>
</html>