Skip to main content
afarber
Inspiring
August 6, 2006
Answered

rtmps with self-signed certificate

  • August 6, 2006
  • 2 replies
  • 1239 views
Hello,

I have a simple Webcam movie, publishing a live-video
to an FMS 2.0.2 r51 dev. edition running on Debian 3.1r2
and then playing it back in another video-window.

It works fine with rtmp and rtmpt, but with rtmps I get
the "NetConnection.Connect.Failed" error.

I've prepared a simple test case and gathered all
infos here: http://pref.dyndns.org:8080/live/live.html

The certificate has been created by me this way:
openssl req -x509 -days 365 -newkey rsa:1024 \
-out self-signed-certificate.pem -keyout pub-sec-key.pem

And put into defaultRoot_/Adaptor.xml:
<HostPort name="edge1" ctl_channel=":19350">:1935,80,-443</HostPort>
.....skipped....
<SSLCertificateFile>/home/afarber/certs/self-signed-certificate.pem</SSLCertificateFile>
<SSLCertificateKeyFile type="PEM">/home/afarber/certs/pub-sec-key.pem</SSLCertificateKeyFile>
<SSLPassPhrase>secret</SSLPassPhrase>
<SSLCipherSuite>ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH</SSLCipherSuite>

I'm sure the server is running as I see in the /var/log/messages:
localhost Adaptor[2675]: Listener started ( _defaultRoot__edge1 ) : 443 (secure)

I've also tried putting
import mx.remoting.Service;
import mx.services.Log;
import mx.remoting.debug.NetDebug;
NetDebug.initialize();

at the top of my AS-code, but the NetConnection Debugger
window displays no inforamtion at all, for some reason:
http://pref.dyndns.org:8080/live/netdebug-empty.gif

Regards
Alex
    This topic is closed to new replies. Start a new post to keep the conversation going.
    Correct answer afarber
    I've found the solution -

    There is a bug in the current Flash player:
    if a dialog window pop-ups for any reason
    (like unknown CA or not matching hostname)
    then the cert will be rejected even if you
    click on "Yes".

    So you generate a self-signed cert like this:

    openssl genrsa -des3 -out ca.key 4096
    openssl req -new -x509 -days 365 -key ca.key -out ca.crt

    openssl genrsa -des3 -out server.key 4096
    openssl req -new -key server.key -out server.csr

    openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

    (increase the 01 above for each new cert).

    and then import the ca.crt from above into your
    browsers (i.e. double-click it on Windows for IE
    and also open it from Mozilla Firefox and click OK).

    Regards
    Alex

    2 replies

    afarberAuthorCorrect answer
    Inspiring
    August 14, 2006
    I've found the solution -

    There is a bug in the current Flash player:
    if a dialog window pop-ups for any reason
    (like unknown CA or not matching hostname)
    then the cert will be rejected even if you
    click on "Yes".

    So you generate a self-signed cert like this:

    openssl genrsa -des3 -out ca.key 4096
    openssl req -new -x509 -days 365 -key ca.key -out ca.crt

    openssl genrsa -des3 -out server.key 4096
    openssl req -new -key server.key -out server.csr

    openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

    (increase the 01 above for each new cert).

    and then import the ca.crt from above into your
    browsers (i.e. double-click it on Windows for IE
    and also open it from Mozilla Firefox and click OK).

    Regards
    Alex
    SScTd
    Participant
    March 19, 2007
    I just verified this with Flash Player 7 and 9.
    The mentioned bug is fixed in Flash Player 9.
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices