Docker installation on macOSX keeps failing with invalid certs #1517

voorjordanp · 2024-01-31T21:41:41Z

voorjordanp
Jan 31, 2024

<?xml version="1.0" encoding="UTF-8" ?>

<Server version="8">
	<Name>OvenMediaEngine</Name>
	<!-- Host type (origin/edge) -->
	<Type>origin</Type>
	<!-- Specify IP address to bind (* means all IPs) -->
	<IP>*</IP>
	<PrivacyProtection>false</PrivacyProtection>
	<!--
	To get the public IP address(mapped address of stun) of the local server.
	This is useful when OME cannot obtain a public IP from an interface, such as AWS or docker environment.
	If this is successful, you can use ${PublicIP} in your settings.
	-->
	<StunServer>stun.ovenmediaengine.com:13478</StunServer>

	<Modules>
		<!--
		Currently OME only supports h2 like all browsers do. Therefore, HTTP/2 only works on TLS ports.
		-->
		<HTTP2>
			<Enable>true</Enable>
		</HTTP2>

		<LLHLS>
			<Enable>true</Enable>
		</LLHLS>

		<!-- P2P works only in WebRTC and is experiment feature -->
		<P2P>
			<!-- disabled by default -->
			<Enable>false</Enable>
			<MaxClientPeersPerHostPeer>2</MaxClientPeersPerHostPeer>
		</P2P>
	</Modules>

	<!-- Settings for the ports to bind -->
	<Bind>
		<!-- Enable this configuration if you want to use API Server -->
		<!--
		<Managers>
			<API>
				<Port>${env:OME_API_PORT:8081}</Port>
				<WorkerCount>1</WorkerCount>
			</API>
		</Managers>
		-->
		<Providers>
			<!-- Pull providers -->
			<RTSPC>
				<WorkerCount>1</WorkerCount>
			</RTSPC>
			<OVT>
				<WorkerCount>1</WorkerCount>
			</OVT>
			<!-- Push providers -->
			<RTMP>
				<Port>${env:OME_RTMP_PROV_PORT:1935}</Port>
				<WorkerCount>1</WorkerCount>
			</RTMP>
			<SRT>
				<Port>${env:OME_SRT_PROV_PORT:9999}</Port>
				<WorkerCount>1</WorkerCount>
			</SRT>
			<!--
			<MPEGTS>
					<- Listen on port 4000
					This is just a demonstration to show that you can configure the port in several ways ->
					<Port>${env:OME_MPEGTS_PROV_PORT:4000-4001,4004,4005/udp}</Port>
				<Port>${env:OME_MPEGTS_PROV_PORT:4000-4005/udp}</Port>
			</MPEGTS>
			-->
			<WebRTC>
				<Signalling>
					<Port>${env:OME_WEBRTC_SIGNALLING_PORT:3333}</Port>
					<TLSPort>${env:OME_WEBRTC_SIGNALLING_TLS_PORT:3334}</TLSPort>
					<WorkerCount>1</WorkerCount>
				</Signalling>
				<IceCandidates>
					<IceCandidate>${env:OME_HOST_IP:*}:${env:OME_WEBRTC_CANDIDATE_PORT:10000-10004/udp}</IceCandidate>
					<TcpRelay>${env:OME_HOST_IP:*}:${env:OME_WEBRTC_TCP_RELAY_PORT:3478}</TcpRelay>
					<TcpForce>true</TcpForce>
					<TcpRelayWorkerCount>1</TcpRelayWorkerCount>
				</IceCandidates>
			</WebRTC>
		</Providers>

		<Publishers>
			<!-- The OVT is protocol for ORIGIN-EDGE -->
			<OVT>
				<Port>${env:OME_ORIGIN_PORT:9000}</Port>
				<WorkerCount>1</WorkerCount>
			</OVT>
			<LLHLS>
				<!--
				OME only supports h2, so LLHLS works over HTTP/1.1 on non-TLS port.
				Note that LLHLS runs higher performance over HTTP/2.
				Therefore, it is recommended to use TLS Port.
				-->
				<Port>${env:OME_LLHLS_STREAM_PORT:3333}</Port>
				<TLSPort>${env:OME_LLHLS_STREAM_TLS_PORT:3334}</TLSPort>
				<WorkerCount>1</WorkerCount>
			</LLHLS>
			<WebRTC>
				<Signalling>
					<Port>${env:OME_WEBRTC_SIGNALLING_PORT:3333}</Port>
					<TLSPort>${env:OME_WEBRTC_SIGNALLING_TLS_PORT:3334}</TLSPort>
					<WorkerCount>1</WorkerCount>
				</Signalling>
				<IceCandidates>
					<IceCandidate>${env:OME_WEBRTC_CANDIDATE_IP:*}:${env:OME_WEBRTC_CANDIDATE_PORT:10000-10004/udp}</IceCandidate>
					<TcpRelay>${env:OME_WEBRTC_CANDIDATE_IP:*}:${env:OME_WEBRTC_TCP_RELAY_PORT:3478}</TcpRelay>
					<TcpForce>true</TcpForce>
					<TcpRelayWorkerCount>1</TcpRelayWorkerCount>
				</IceCandidates>
			</WebRTC>
		</Publishers>
	</Bind>

	<VirtualHosts>
		<!--
			You can include multiple XML files by doing the following:
			<VirtualHost include="sites-enabled/*.xml" />
		-->
		<VirtualHost include="VHost*.xml" />
		<VirtualHost>
			<Name>default</Name>
			<!--Distribution is a value that can be used when grouping the same vhost distributed across multiple servers. This value is output to the events log, so you can use it to aggregate statistics. -->
			<Distribution>ovenmediaengine.com</Distribution>

			<!-- Settings for multi ip/domain and TLS -->
			<Host>
				<Names>
					<!-- Host names
						<Name>stream1.airensoft.com</Name>
						<Name>stream2.airensoft.com</Name>
						<Name>*.sub.airensoft.com</Name>
						<Name>192.168.0.1</Name>
					-->
					<Name>*</Name>
				</Names>
				<TLS>
					<CertPath>/opt/ovenmediaengine/conf/cert.crt</CertPath>
					<KeyPath>/opt/ovenmediaengine/conf/cert.key</KeyPath>
					<ChainCertPath>/opt/ovenmediaengine/conf/cert.ca-bundle</ChainCertPath>
				</TLS>
			</Host>

			<!-- Refer https://airensoft.gitbook.io/ovenmediaengine/signedpolicy
			<SignedPolicy>
				<PolicyQueryKeyName>policy</PolicyQueryKeyName>
				<SignatureQueryKeyName>signature</SignatureQueryKeyName>
				<SecretKey>aKq#1kj</SecretKey>

				<Enables>
					<Providers>rtmp,webrtc,srt</Providers>
					<Publishers>webrtc,hls,llhls,dash,lldash</Publishers>
				</Enables>
			</SignedPolicy>
			-->

			<!--
			<OriginMapStore>
				In order to use OriginMap, you must enable OVT Publisher in Origin and OVT Provider in Edge.
				<RedisServer>
					<Host>192.168.0.160:6379</Host>
					<Auth>!@#ovenmediaengine</Auth>
				</RedisServer>

				This is only needed for the origin server and used to register the ovt address of the stream.
				<OriginHostName>${env:OME_HOST_IP:192.168.0.160}</OriginHostName>
			</OriginMapStore>
			-->

			<!-- Default CORS Settings -->
			<CrossDomains>
				<Url>*</Url>
			</CrossDomains>

			<!-- Settings for applications -->
			<Applications>
				<Application>
					<Name>app</Name>
					<!-- Application type (live/vod) -->
					<Type>live</Type>
					<OutputProfiles>
						<!--  This option is deprecated. Please use the 'HWAccels' option. -->
						<!--
							<HardwareAcceleration>false</HardwareAcceleration>
						-->

						<!-- Enable this configuration if you want to hardware acceleration using GPU -->
						<HWAccels>
							<Decoder>
									<Enable>false</Enable>
									<!--
										Setting for Hardware Modules.
										 - xma :Xilinx Media Accelerator
										 - qsv :Intel Quick Sync Video
										 - nv : Nvidia Video Codec SDK
										 - nilogan: Netint VPU

										You can use multiple modules by separating them with commas.
										For example, if you want to use xma and nv, you can set it as follows.

										<Modules>[ModuleName]:[DeviceId],[ModuleName]:[DeviceId],...</Modules>
										<Modules>xma:0,nv:0</Modules>
									-->
									<!-- <Modules>nv</Modules> -->
							</Decoder>
							<Encoder>
									<Enable>false</Enable>
									<!-- <Modules>nv:0</Modules> -->
							</Encoder>
						</HWAccels>

						<OutputProfile>
							<Name>bypass_stream</Name>
							<OutputStreamName>${OriginStreamName}</OutputStreamName>

							<!--
							You can provide ABR with Playlist. Currently, ABR is supported in LLHLS and WebRTC.

							<Playlist>
								<Name>Paid</Name>
								You can play this playlist with
								LLHLS : http[s]://<domain>[:port]/<app>/<stream>/<FileName>.m3u8
								WebRTC : ws[s]://<domain>[:port]/<app>/<stream>/<FileName>
								Note that the keywords "playlist" and "chunklist" MUST NOT be included in FileName.
								<FileName>premium</FileName>

								Options is optional.
								<Options>
									WebRtcAutoAbr : Default value is true
									<WebRtcAutoAbr>true</WebRtcAutoAbr>
								</Options>

								<Rendition>
									<Name>bypass</Name>
									<Video>bypass_video</Video>
									<Audio>bypass_audio</Audio>
								</Rendition>
								<Rendition>
									<Name>480p</Name>
									<Video>480p</Video>
									<Audio>bypass_audio</Audio>
								</Rendition>
								<Rendition>
									<Name>720p</Name>
									<Video>720p</Video>
									<Audio>bypass_audio</Audio>
								</Rendition>
							</Playlist>
							<Playlist>
								<Name>free</Name>
								<FileName>free</FileName>
								<Rendition>
									<Name>720p</Name>
									<Video>720p</Video>
									<Audio>bypass_audio</Audio>
								</Rendition>
							</Playlist>
							-->

							<Encodes>
								<Video>
									<Name>bypass_video</Name>
									<Bypass>true</Bypass>
								</Video>
								<Audio>
									<Name>aac_audio</Name>
									<Codec>aac</Codec>
									<Bitrate>128000</Bitrate>
									<Samplerate>48000</Samplerate>
									<Channel>2</Channel>
									<BypassIfMatch>
										<Codec>eq</Codec>
									</BypassIfMatch>
								</Audio>
								<Audio>
									<Name>opus_audio</Name>
									<Codec>opus</Codec>
									<Bitrate>128000</Bitrate>
									<Samplerate>48000</Samplerate>
									<Channel>2</Channel>
									<BypassIfMatch>
										<Codec>eq</Codec>
									</BypassIfMatch>
								</Audio>
								<!--
								<Video>
									<Name>video_1280</Name>
									<Codec>h264</Codec>
									<Bitrate>5024000</Bitrate>
									<Framerate>30</Framerate>
									<Width>1920</Width>
									<Height>1280</Height>
									<Preset>faster</Preset>
								</Video>
								<Video>
									<Name>video_720</Name>
									<Codec>h264</Codec>
									<Bitrate>2024000</Bitrate>
									<Framerate>30</Framerate>
									<Width>1280</Width>
									<Height>720</Height>
									<Preset>faster</Preset>
								</Video>
								-->
							</Encodes>
						</OutputProfile>
					</OutputProfiles>
					<Providers>
						<OVT />
						<WebRTC>
							<Timeout>30000</Timeout>
							<CrossDomains>
								<Url>*</Url>
							</CrossDomains>
						</WebRTC>
						<RTMP />
						<SRT />
						<RTSPPull />
						<Schedule>
							<MediaRootDir>/opt/ovenmediaengine/media</MediaRootDir>
							<ScheduleFilesDir>/opt/ovenmediaengine/media</ScheduleFilesDir>
						</Schedule>
						<!-- <MPEGTS>
							<StreamMap>
									<- Set the stream name of the client connected to the port to "stream_${Port}"
									For example, if a client connets to port 4000, OME creates a "stream_4000" stream ->
									<Stream>
										<Name>stream_${Port}</Name>
										<Port>4000,4001-4004</Port>
									</Stream>
									<Stream>
										<Name>stream_4005</Name>
										<Port>4005</Port>
									</Stream>
								<Stream>
									<Name>stream_${Port}</Name>
									<Port>${env:OME_MPEGTS_PROV_PORT:4000-4005/udp}</Port>
								</Stream>
							</StreamMap>
						</MPEGTS> -->
					</Providers>
                    <Publishers>
                      <AppWorkerCount>1</AppWorkerCount>
                      <StreamWorkerCount>8</StreamWorkerCount>
                      <OVT />
                      <WebRTC>
                        <Timeout>30000</Timeout>
                        <Rtx>false</Rtx>
                        <Ulpfec>false</Ulpfec>
                        <JitterBuffer>false</JitterBuffer>
                      </WebRTC>
                      <LLHLS>
                        <OriginMode>true</OriginMode>
                        <!--
                        <CacheControl>
                          <MasterPlaylistMaxAge>0</MasterPlaylistMaxAge>
                          <ChunklistMaxAge>0</ChunklistMaxAge>
                          <ChunklistWithDirectivesMaxAge>60</ChunklistWithDirectivesMaxAge>
                          <SegmentMaxAge>-1</SegmentMaxAge>
                          <PartialSegmentMaxAge>-1</PartialSegmentMaxAge>
                        </CacheControl>
                        -->
                        <ChunkDuration>0.5</ChunkDuration>
                        <!-- PartHoldBack SHOULD be at least three times the Part Target Duration -->
                        <PartHoldBack>1.5</PartHoldBack>
                        <SegmentDuration>6</SegmentDuration>
                        <SegmentCount>10</SegmentCount>
                        <CrossDomains>
                          <Url>*</Url>
                        </CrossDomains>
                      </LLHLS>
                      <FILE>
                        <RootPath>/opt/ovenmediaengine/shared_volumes</RootPath>
                        <FilePath>/${VirtualHost}/${Application}/${Stream}/${StartTime:YYYYMMDDhhmmss}_${EndTime:YYYYMMDDhhmmss}.ts</FilePath>
                        <InfoPath>/${VirtualHost}/${Application}/${Stream}.xml</InfoPath>
                      </FILE>
                    </Publishers>
				</Application>
			</Applications>
		</VirtualHost>
	</VirtualHosts>
</Server>

total 72
drwxrwxr-x  9 x  staff    288 Jan 31 22:37 .
drwxrwxr-x  5 root    wheel    160 Jan 31 21:51 ..
-rw-r--r--  1 x  staff    386 Jan 16 11:10 Logger.xml
-rw-r--r--  1 x  staff     36 Jan 31 21:41 Server.id
-rw-r--r--@ 1 x  staff  12287 Jan 31 22:21 Server.xml
-rw-r--r--  1 x  staff   1334 Jan 31 22:37 cert.ca-bundle
-rw-r--r--  1 x  staff   1334 Jan 31 22:36 cert.crt
-rw-r--r--  1 x  staff   1033 Jan 31 22:36 cert.csr
-rw-------  1 x  staff   1708 Jan 31 22:36 cert.key

I tried both

<TLS>
					<CertPath>/opt/ovenmediaengine/conf/cert.crt</CertPath>
					<KeyPath>/opt/ovenmediaengine/conf/cert.key</KeyPath>
					<ChainCertPath>/opt/ovenmediaengine/conf/cert.ca-bundle</ChainCertPath>
				</TLS>

and

<TLS>
					<CertPath>/conf/cert.crt</CertPath>
					<KeyPath>/conf/cert.key</KeyPath>
					<ChainCertPath>/conf/cert.ca-bundle</ChainCertPath>
				</TLS>

Generated certificated for localhost with:

x@dev  /opt/ovenmediaengine/conf  openssl genrsa -out cert.key 2048
 x@dev  /opt/ovenmediaengine/conf  openssl req -new -key cert.key -out cert.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:NL
State or Province Name (full name) [Some-State]:OV
Locality Name (eg, city) []:amsterdam
Organization Name (eg, company) [Internet Widgits Pty Ltd]:acquired
Organizational Unit Name (eg, section) []:nl
Common Name (e.g. server FQDN or YOUR name) []:FQDN
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
 pascal@dev  /opt/ovenmediaengine/conf  openssl x509 -req -days 365 -in cert.csr -signkey cert.key -out cert.crt
Certificate request self-signature ok
subject=C=NL, ST=OV, L=amsterdam, O=ovulom, OU=nl, CN=FQDN, [email protected]
 x@dev  /opt/ovenmediaengine/conf  cp cert.crt cert.ca-bundle

The server logs always complain:

[2024-01-31 21:38:12.802] I [OvenMediaEngine:1] Config | config_manager.cpp:239  | Trying to set logfile in directory... (/var/log/ovenmediaengine)
[2024-01-31 21:38:12.803] I [OvenMediaEngine:1] Config | config_manager.cpp:261  | Trying to load configurations... (origin_conf/Server.xml)
[2024-01-31 21:38:12.808] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:23   | OvenMediaEngine v0.16.4 ((From archive)) is started on [861616dd0543] (Linux aarch64 - 6.4.16-linuxkit, #1 SMP PREEMPT Thu Nov 16 10:49:20 UTC 2023)
[2024-01-31 21:38:12.808] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:27   | With modules:
[2024-01-31 21:38:12.808] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:28   |   FFmpeg 5.0.1
[2024-01-31 21:38:12.808] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:29   |     Configuration: --prefix=/opt/ovenmediaengine --extra-cflags='-I/opt/ovenmediaengine/include ' --extra-ldflags='-L/opt/ovenmediaengine/lib -Wl,-rpath,/opt/ovenmediaengine/lib ' --extra-libs=-ldl --disable-everything --disable-programs --disable-avdevice --disable-dwt --disable-lsp --disable-lzo --disable-faan --disable-pixelutils --enable-shared --enable-zlib --enable-libopus --enable-libvpx --enable-libfdk_aac --enable-libopenh264 --enable-openssl --enable-network --enable-libsrt --enable-dct --enable-rdft --disable-nvdec --disable-nvdec --disable-vaapi --disable-vdpau --disable-cuda-llvm --disable-cuvid --disable-ffnvcodec --enable-ffmpeg --enable-encoder='libvpx_vp8,libopus,libfdk_aac,libopenh264,mjpeg,png' --enable-decoder='aac,aac_latm,aac_fixed,mp3float,mp3,h264,hevc,opus,vp8' --enable-parser='aac,aac_latm,aac_fixed,h264,hevc,opus,vp8' --enable-protocol='tcp,udp,rtp,file,rtmp,tls,rtmps,libsrt' --enable-demuxer='rtsp,flv,live_flv,mp4,mp3' --enable-muxer='mp4,webm,mpegts,flv,mpjpeg' --enable-filter='asetnsamples,aresample,aformat,channelmap,channelsplit,scale,transpose,fps,settb,asettb,format'
[2024-01-31 21:38:12.808] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:30   |     libavformat: 59.16.100
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:31   |     libavcodec: 59.18.100
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:32   |     libavutil: 57.17.100
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:33   |     libavfilter: 8.24.100
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:34   |     libswresample: 4.3.100
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:35   |     libswscale: 6.4.100
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:36   |   SRT: 1.5.2
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:37   |   SRTP: libsrtp2 2.4.2
[2024-01-31 21:38:12.809] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:38   |   OpenSSL: OpenSSL 3.0.7 1 Nov 2022
[2024-01-31 21:38:12.810] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:39   |     Configuration: compiler: gcc -fPIC -pthread -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
[2024-01-31 21:38:12.810] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:40   |   JsonCpp: 1.9.3
[2024-01-31 21:38:12.810] I [OvenMediaEngine:1] OvenMediaEngine | banner.cpp:41   |   jemalloc: 5.3.0-0-g54eaed1d8b56b1aa528be3bdd1877e59c56fa90c
[2024-01-31 21:38:12.810] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:73   | Server ID : 7e91ee16-753c-46ce-ae55-216be1734c2b
[2024-01-31 21:38:12.910] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:91   | Resolved public IP address (84.245.37.197) from stun server (stun.ovenmediaengine.com:13478)
[2024-01-31 21:38:12.910] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:109  | This host supports IPv4 only (reason: v6: Failed to bind(): [errno] Cannot assign requested address (99)[0])
[2024-01-31 21:38:12.914] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:126  | Trying to create MediaRouter...
[2024-01-31 21:38:12.914] I [OvenMediaEngine:1] MediaRouter | mediarouter.cpp:40   | Mediarouter has been started.
[2024-01-31 21:38:12.914] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:129  | Trying to create WebRTC Publisher...
[2024-01-31 21:38:12.914] I [OvenMediaEngine:1] Signalling.P2P | rtc_p2p_manager.cpp:27   | P2P is disabled in the configuration
[2024-01-31 21:38:12.915] I [OvenMediaEngine:1] HTTP.Server | http_server_manager.cpp:319  | WebRTC Publisher is listening on *:3333 (TLS: *:3334)...
[2024-01-31 21:38:12.916] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 84.245.37.197:10000
[2024-01-31 21:38:12.916] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 172.17.0.2:10000
[2024-01-31 21:38:12.916] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 84.245.37.197:10001
[2024-01-31 21:38:12.917] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 172.17.0.2:10001
[2024-01-31 21:38:12.917] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 84.245.37.197:10002
[2024-01-31 21:38:12.917] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 172.17.0.2:10002
[2024-01-31 21:38:12.917] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 84.245.37.197:10003
[2024-01-31 21:38:12.918] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 172.17.0.2:10003
[2024-01-31 21:38:12.918] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 84.245.37.197:10004
[2024-01-31 21:38:12.918] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 172.17.0.2:10004
[2024-01-31 21:38:12.919] I [OvenMediaEngine:1] ICE | ice_port.cpp:113  | ICE ports are listening on *:10004/UDP (0xffff860e2610), *:10003/UDP (0xffff860e2910), *:10002/UDP (0xffff860e2c10), *:10001/UDP (0xffff860e2f10), *:10000/UDP (0xffff860e3210) (for WebRTC Publisher)
[2024-01-31 21:38:12.920] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:191  | TURN port is listening on *:3478/TCP (for WebRTC Publisher)
[2024-01-31 21:38:12.920] I [OvenMediaEngine:1] Publisher | publisher.cpp:19   | WebRTC Publisher has been started.
[2024-01-31 21:38:12.920] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:130  | Trying to create LLHLS Publisher...
[2024-01-31 21:38:12.921] I [OvenMediaEngine:1] HTTP.Server | http_server_manager.cpp:319  | LLHLS Publisher is listening on *:3333 (TLS: *:3334)...
[2024-01-31 21:38:12.921] I [OvenMediaEngine:1] Publisher | publisher.cpp:19   | LLHLS Publisher has been started.
[2024-01-31 21:38:12.921] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:131  | Trying to create HLS Publisher...
[2024-01-31 21:38:12.922] W [OvenMediaEngine:1] HLS | hls_publisher.cpp:38   | HLS Publisher is disabled by configuration
[2024-01-31 21:38:12.922] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:132  | Trying to create MPEG-DASH Publisher...
[2024-01-31 21:38:12.922] W [OvenMediaEngine:1] DASH | dash_publisher.cpp:36   | DASH Publisher is disabled by configuration
[2024-01-31 21:38:12.923] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:133  | Trying to create Low-Latency MPEG-DASH Publisher...
[2024-01-31 21:38:12.923] W [OvenMediaEngine:1] LLDASH | cmaf_publisher.cpp:39   | LLDASH Publisher is disabled by configuration
[2024-01-31 21:38:12.923] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:134  | Trying to create OVT Publisher...
[2024-01-31 21:38:12.924] I [OvenMediaEngine:1] OVT | ovt_publisher.cpp:90   | OVTPublisher is listening on *:9000/TCP...
[2024-01-31 21:38:12.924] I [OvenMediaEngine:1] Publisher | publisher.cpp:19   | OVTPublisher has been started.
[2024-01-31 21:38:12.924] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:135  | Trying to create File Publisher...
[2024-01-31 21:38:12.925] I [OvenMediaEngine:1] Publisher | publisher.cpp:19   | FilePublisher has been started.
[2024-01-31 21:38:12.925] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:136  | Trying to create MpegtsPush Publisher...
[2024-01-31 21:38:12.925] I [OvenMediaEngine:1] Publisher | publisher.cpp:19   | MPEGTSPushPublisher has been started.
[2024-01-31 21:38:12.926] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:137  | Trying to create RtmpPush Publisher...
[2024-01-31 21:38:12.926] I [OvenMediaEngine:1] Publisher | publisher.cpp:19   | RTMPPushPublisher has been started.
[2024-01-31 21:38:12.926] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:138  | Trying to create SrtPush Publisher...
[2024-01-31 21:38:12.926] I [OvenMediaEngine:1] Publisher | publisher.cpp:19   | SRTPushPublisher has been started.
[2024-01-31 21:38:12.927] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:139  | Trying to create Thumbnail Publisher...
[2024-01-31 21:38:12.927] W [OvenMediaEngine:1] Thumbnail | thumbnail_publisher.cpp:79   | ThumbnailPublisher is disabled by configuration
[2024-01-31 21:38:12.927] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:142  | Trying to create Transcoder...
[2024-01-31 21:38:12.927] I [OvenMediaEngine:1] Transcoder | transcoder_gpu.cpp:43   | Trying to check the hardware accelerator
[2024-01-31 21:38:12.927] W [OvenMediaEngine:1] Transcoder | transcoder_gpu.cpp:52   | No supported NVIDIA Accelerator
[2024-01-31 21:38:12.928] W [OvenMediaEngine:1] Transcoder | transcoder_gpu.cpp:62   | No supported Xilinx Media Accelerator
[2024-01-31 21:38:12.928] W [OvenMediaEngine:1] Transcoder | transcoder_gpu.cpp:72   | No supported Intel QuickSync Accelerator
[2024-01-31 21:38:12.928] W [OvenMediaEngine:1] Transcoder | transcoder_gpu.cpp:82   | No supported Netint VPU Accelerator
[2024-01-31 21:38:12.928] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:145  | Trying to create WebRTC Provider...
[2024-01-31 21:38:12.929] I [OvenMediaEngine:1] Signalling.P2P | rtc_p2p_manager.cpp:27   | P2P is disabled in the configuration
[2024-01-31 21:38:12.929] I [OvenMediaEngine:1] HTTP.Server | http_server_manager.cpp:319  | WebRTCProvider is listening on *:3333 (TLS: *:3334)...
[2024-01-31 21:38:12.929] I [OvenMediaEngine:1] HTTP.Server | http_server_manager.cpp:319  | WebRTCProvider is listening on *:3333 (TLS: *:3334)...
[2024-01-31 21:38:12.930] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 127.0.0.1:10000 (host: 'localhost')
[2024-01-31 21:38:12.930] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 127.0.0.1:10001 (host: 'localhost')
[2024-01-31 21:38:12.930] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 127.0.0.1:10002 (host: 'localhost')
[2024-01-31 21:38:12.930] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 127.0.0.1:10003 (host: 'localhost')
[2024-01-31 21:38:12.931] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:305  | ICE candidate found: 127.0.0.1:10004 (host: 'localhost')
[2024-01-31 21:38:12.931] I [OvenMediaEngine:1] ICE | ice_port.cpp:113  | ICE ports are listening on *:10004/UDP (0xffff860e2610), *:10003/UDP (0xffff860e2910), *:10002/UDP (0xffff860e2c10), *:10001/UDP (0xffff860e2f10), *:10000/UDP (0xffff860e3210) (for WebRTCProvider)
[2024-01-31 21:38:12.931] I [OvenMediaEngine:1] ICE | ice_port_manager.cpp:191  | TURN port is listening on *:3478/TCP (for WebRTCProvider)
[2024-01-31 21:38:12.932] I [OvenMediaEngine:1] Provider | provider.cpp:37   | WebRTCProvider has been started.
[2024-01-31 21:38:12.932] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:146  | Trying to create MPEG-TS Provider...
[2024-01-31 21:38:12.933] W [OvenMediaEngine:1] MpegtsProvider | mpegts_provider.cpp:147  | MPEGTSProvider is disabled by configuration
[2024-01-31 21:38:12.933] I [OvenMediaEngine:1] MpegtsProvider | mpegts_provider.cpp:39   | Terminated Mpegts Provider module.
[2024-01-31 21:38:12.933] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:147  | Trying to create SRT Provider...
[2024-01-31 21:38:12.934] I [OvenMediaEngine:1] SrtProvider | srt_provider.cpp:116  | SrtProvider is listening on *:9999/SRT
[2024-01-31 21:38:12.934] I [OvenMediaEngine:1] Provider | provider.cpp:37   | SrtProvider has been started.
[2024-01-31 21:38:12.934] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:148  | Trying to create RTMP Provider...
[2024-01-31 21:38:12.935] I [OvenMediaEngine:1] RTMPProvider | rtmp_provider.cpp:138  | RTMPProvider is listening on *:1935
[2024-01-31 21:38:12.935] I [OvenMediaEngine:1] Provider | provider.cpp:37   | RTMPProvider has been started.
[2024-01-31 21:38:12.935] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:149  | Trying to create OVT Provider...
[2024-01-31 21:38:12.936] I [OvenMediaEngine:1] Provider | provider.cpp:37   | OVTProvider has been started.
[2024-01-31 21:38:12.936] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:150  | Trying to create RTSPC Provider...
[2024-01-31 21:38:12.936] I [OvenMediaEngine:1] Provider | provider.cpp:37   | RTSPCProvider has been started.
[2024-01-31 21:38:12.937] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:151  | Trying to create File Provider...
[2024-01-31 21:38:12.937] I [OvenMediaEngine:1] Provider | provider.cpp:37   | FileProvider has been started.
[2024-01-31 21:38:12.937] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:152  | Trying to create Scheduled Provider...
[2024-01-31 21:38:12.938] I [OvenMediaEngine:1] Provider | provider.cpp:37   | ScheduledProvider has been started.
[2024-01-31 21:38:12.938] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:153  | Trying to create Multiplex Provider...
[2024-01-31 21:38:12.938] I [OvenMediaEngine:1] Provider | provider.cpp:37   | MultiplexProvider has been started.
[2024-01-31 21:38:12.938] I [OvenMediaEngine:1] OvenMediaEngine | main.cpp:160  | All modules are initialized successfully
[2024-01-31 21:38:12.939] I [OvenMediaEngine:1] Monitor | monitoring.cpp:75   | OvenMediaEngine(7e91ee16-753c-46ce-ae55-216be1734c2b) ServerMetric has been started for monitoring - 2024-01-31T21:38:12.939+00:00
[2024-01-31 21:38:12.939] E [OvenMediaEngine:1] Certificate | certificate.cpp:47   | Failed to create a certificate for VirtualHost [default]:
        Reason: [default] Could not create a certificate from file - [OpenSSL] error:16000069:STORE routines::unregistered scheme (369098857)
        Cert file path: /opt/ovenmediaengine/conf/cert.crt
        Chain cert file path: /opt/ovenmediaengine/conf/cert.ca-bundle
        Private key file path: /opt/ovenmediaengine/conf/cert.key
[2024-01-31 21:38:12.939] I [OvenMediaEngine:1] Monitor | server_metrics.cpp:61   | Create HostMetrics(default/7e91ee16-753c-46ce-ae55-216be1734c2b/default) for monitoring
[2024-01-31 21:38:12.940] I [OvenMediaEngine:1] Orchestrator | orchestrator_internal.cpp:821  | Trying to create an application: [#default#app]
[2024-01-31 21:38:12.940] I [OvenMediaEngine:1] Monitor | host_metrics.cpp:58   | Create ApplicationMetrics(#default#app/7e91ee16-753c-46ce-ae55-216be1734c2b/default/#default#app) for monitoring
[2024-01-31 21:38:12.940] I [OvenMediaEngine:1] MediaRouter | mediarouter_application.cpp:51   | [#default#app(0)] Created Mediarouter application. worker(1)
[2024-01-31 21:38:12.940] I [OvenMediaEngine:1] MediaRouter | mediarouter.cpp:83   | Created Mediarouter. app(#default#app)
[2024-01-31 21:38:12.941] I [OvenMediaEngine:1] Publisher | application.cpp:181  | WebRTC Publisher Application has created [#default#app] application
[2024-01-31 21:38:12.941] I [OvenMediaEngine:1] Publisher | application.cpp:181  | LLHLS Publisher Application has created [#default#app] application
[2024-01-31 21:38:12.942] I [OvenMediaEngine:1] Publisher | application.cpp:181  | OVTPublisher Application has created [#default#app] application
[2024-01-31 21:38:12.942] I [OvenMediaEngine:1] Publisher | application.cpp:181  | FilePublisher Application has created [#default#app] application
[2024-01-31 21:38:12.942] W [OvenMediaEngine:1] Publisher | publisher.cpp:70   | MPEGTSPush publisher is disabled in #default#app application, so it was not created
[2024-01-31 21:38:12.942] W [OvenMediaEngine:1] Publisher | publisher.cpp:70   | RTMPPush publisher is disabled in #default#app application, so it was not created
[2024-01-31 21:38:12.943] W [OvenMediaEngine:1] Publisher | publisher.cpp:70   | SRTPush publisher is disabled in #default#app application, so it was not created
[2024-01-31 21:38:12.943] I [OvenMediaEngine:1] Transcoder | transcoder_application.cpp:34   | Created transcoder application. [#default#app]
[2024-01-31 21:38:12.943] I [OvenMediaEngine:1] Transcoder | transcoder.cpp:94   | Transcoder has created [config][#default#app] application
[2024-01-31 21:38:12.944] I [OvenMediaEngine:1] Provider | application.cpp:46   | WebRTCProvider has created [#default#app] application
[2024-01-31 21:38:12.944] I [OvenMediaEngine:1] Provider | application.cpp:46   | SrtProvider has created [#default#app] application
[2024-01-31 21:38:12.944] I [OvenMediaEngine:1] Provider | application.cpp:46   | RTMPProvider has created [#default#app] application
[2024-01-31 21:38:12.944] I [OvenMediaEngine:1] Provider | application.cpp:46   | OVTProvider has created [#default#app] application
[2024-01-31 21:38:12.945] I [OvenMediaEngine:1] Provider | application.cpp:46   | RTSPCProvider has created [#default#app] application
[2024-01-31 21:38:12.945] I [OvenMediaEngine:1] Provider | application.cpp:46   | ScheduledProvider has created [#default#app] application
[2024-01-31 21:38:12.945] W [OvenMediaEngine:1] Provider | provider.cpp:93   | Multiplex provider is disabled in #default#app application, so it was not created
[2024-01-31 21:38:12.945] I [OvenMediaEngine:1] APIServer | api_server.cpp:123  | API Server is disabled by configuration

what do I overlook?

Thank your for this amazing server!

voorjordanp · 2024-01-31T22:27:29Z

voorjordanp
Jan 31, 2024
Author

Based on this:
#817

I changed server TLS location towards

<Bind>
		<Managers>
			<API>
				<Port>${env:OME_API_PORT:8081}</Port>
				<WorkerCount>1</WorkerCount>
			</API>
			<TLS>
				<CertPath>/opt/ovenmediaengine/conf/cert.crt</CertPath>
				<KeyPath>/opt/ovenmediaengine/conf/cert.key</KeyPath>
				<ChainCertPath>/opt/ovenmediaengine/conf/cert.ca-bundle</ChainCertPath>
			</TLS>
		</Managers>

yet still same error:

0 replies

voorjordanp · 2024-01-31T22:28:46Z

voorjordanp
Jan 31, 2024
Author

Additional I tried the startup script
But it seems to not run on OSX.

7 replies

voorjordanp Jan 31, 2024
Author

TLS back @ here seems correct config wise

<VirtualHost>
			<Name>default</Name>
			<!--Distribution is a value that can be used when grouping the same vhost distributed across multiple servers. This value is output to the events log, so you can use it to aggregate statistics. -->
			<Distribution>ovenmediaengine.com</Distribution>

			<!-- Settings for multi ip/domain and TLS -->
			<Host>
				<Names>
					<!-- Host names
						<Name>stream1.airensoft.com</Name>
						<Name>stream2.airensoft.com</Name>
						<Name>*.sub.airensoft.com</Name>
						<Name>192.168.0.1</Name>
					-->
					<Name>*</Name>
				</Names>
				<TLS>
					<CertPath>/opt/ovenmediaengine/conf/cert.crt</CertPath>
					<KeyPath>/opt/ovenmediaengine/conf/cert.key</KeyPath>
					<ChainCertPath>/opt/ovenmediaengine/conf/cert.ca-bundle</ChainCertPath>
				</TLS>
			</Host>

but

bchah Feb 1, 2024
Collaborator Sponsor

The error implies that the version of OpenSSL in use isn't compatible with your cert. Can you try it with a known-good CA like LetsEncrypt?

bchah Feb 1, 2024
Collaborator Sponsor

Or can you try PEM-encoded?

voorjordanp Feb 19, 2024
Author

I see i gave up on this after many hours.
Just ro much hassle.
An improvement here or better docs would help the dx. I moved to another project for my liveencoding which has other issues though ;)

Johnr24 Feb 15, 2025

The error implies that the version of OpenSSL in use isn't compatible with your cert. Can you try it with a known-good CA like LetsEncrypt?

Hi I've tried this with lets encrpyt and yet I still get the same error,

Johnr24 · 2025-02-15T15:16:22Z

Johnr24
Feb 15, 2025

Hi There is a clear issue with the documentation, for example it does not specify an example from certs provided from letsencrypt.

It would be useful if it did as it would appear their is a general issue with macos & TLS

2 replies

bchah Feb 15, 2025
Collaborator Sponsor

TLS works on macOS, I deploy it all the time. It's likely either a configuration issue or a permissions issue where OME is running as a user that can't properly read the certs. Can you please share more information about your config? For example, OP shared a config where they had hostnames set to "*" which I don't think would work so hot with TLS.

Johnr24 Feb 18, 2025

Hi,
I've updated the standard docker compose file and I also have some changes to the documentation docker and TLS which would be good to update the docker compose changes are in my pull request

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docker installation on macOSX keeps failing with invalid certs #1517

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 9 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Docker installation on macOSX keeps failing with invalid certs #1517

voorjordanp Jan 31, 2024

Replies: 3 comments · 9 replies

voorjordanp Jan 31, 2024 Author

voorjordanp Jan 31, 2024 Author

voorjordanp Jan 31, 2024 Author

bchah Feb 1, 2024 Collaborator Sponsor

bchah Feb 1, 2024 Collaborator Sponsor

voorjordanp Feb 19, 2024 Author

Johnr24 Feb 15, 2025

Johnr24 Feb 15, 2025

bchah Feb 15, 2025 Collaborator Sponsor

Johnr24 Feb 18, 2025

voorjordanp
Jan 31, 2024

Replies: 3 comments 9 replies

voorjordanp
Jan 31, 2024
Author

voorjordanp
Jan 31, 2024
Author

voorjordanp Jan 31, 2024
Author

bchah Feb 1, 2024
Collaborator Sponsor

bchah Feb 1, 2024
Collaborator Sponsor

voorjordanp Feb 19, 2024
Author

Johnr24
Feb 15, 2025

bchah Feb 15, 2025
Collaborator Sponsor