Automatic LetsEncrypt setup and renewal are only available in the Docker installation. For other installation types, you can directly use Certbot.
LetsEncrypt is a free and simple way to allow safe and secure connections to your AzuraCast installation. With a valid SSL certificate, you can:
Secure your connection to AzuraCast when administering your stations,
Enforce security for all AzuraCast administrators via HTTP Strict Transport Security (HSTS), and
Provide a secure listening endpoint to listeners, avoiding "Mixed Content" warnings when your radio signal is played from a secure web page.
Before setting up LetsEncrypt, you should make sure the following conditions are met:
AzuraCast must be on its own domain or subdomain. You can't set up LetsEncrypt using only an IP address; you must have a domain (i.e. mysite.com) or a subdomain (radio.mysite.com) set up to point to your AzuraCast installation.
AzuraCast's web server must be served on the default ports, 80 for HTTP and 443 for HTTPS. By default, AzuraCast is already set up this way, but if you've modified the ports to serve the site on a secondary port, you must switch the ports back to the defaults when setting up LetsEncrypt and when performing renewals.
Connect to your host server via a terminal (SSH) connection and execute the following commands:
cd /var/azuracast
./docker.sh update-self
./docker.sh letsencrypt-create
Answer the prompts as shown to complete the setup process.
The web service will automatically renew your LetsEncrypt certificates. If you provide an e-mail in the initial setup process, that e-mail will be used to send you reminders of upcoming expiration in the event that automatic renewal fails.
If users are still having issues with audio not playing, please ensure you have the Web Proxy Radio Option enabled in your System Settings.
The first thing that you should do when you have set up Let's Encrypt as described above and you still see AzuraCast serving a self-signed certificate is to restart AzuraCast via the following commands:
docker-compose down
docker-compose up -d
After starting AzuraCast, wait a few minutes just to be sure that everything has started up correctly then check if AzuraCast is still serving the self-signed certificate.
If it is still serving the self-signed certificate, take a look into the logs of the web container to see if there are any errors related to retrieving or renewing the certificate:
docker-compose logs -f web
If you have a custom SSL certificate on your host, you should create a docker-compose.override.yml file in your /var/azuracast directory on the host server with the contents below, modified to reflect your domain name and the path to your SSL certificate and key:
services:
web:
volumes:
- /path/on/host/to/ssl.crt:/etc/nginx/certs/ssl.crt:ro
- /path/on/host/to/ssl.key:/etc/nginx/certs/ssl.key:ro
services:
web:
volumes:
- /path/on/host/to/ssl.crt:/etc/nginx/certs/ssl.crt:ro
- /path/on/host/to/ssl.key:/etc/nginx/certs/ssl.key:ro
stations:
volumes:
- /path/on/host/to/ssl.crt:/etc/nginx/certs/ssl.crt:ro
- /path/on/host/to/ssl.key:/etc/nginx/certs/ssl.key:ro
Please note that Icecast expects an RSA private key as well as a certificate file with the complete certificate chain. For custom certificates in the
.pemformat generated by something likeCertbotyou will need to convert them like this:
openssl rsa -in privkey.pem -out example.com.key
openssl crl2pkcs7 -nocrl -certfile fullchain.pem | openssl pkcs7 -print_certs -out example.com.crt
Finally you need to restart AzuraCast in order to apply the changes:
docker-compose down
docker-compose up -d