Direct HTTPS in Castreon and pinned sources

Castreon also serves the panel, the API and delivery (HLS, DASH, HTTP-TS) over HTTPS, directly, with no nginx or other proxy in front. Everything that leaves the server is encrypted with TLS: anyone along the way only sees encrypted traffic to an address, not the channel addresses and not the content.

Between two Castreon servers — for example a station that ingests the channels and a server that distributes them further — the connection can also be verified: the server pulling the channel accepts only its own station's certificate, by fingerprint (pin). Nobody can get in the middle.

Available from Castreon 1.5.1, in all plans.

Turning on HTTPS

1. Open Settings → HTTPS.
2. Tick HTTPS on.
3. HTTPS port — 33443 by default, different from the HTTP port. Open it in the firewall (TCP).
4. Choose the Certificate (see below) and click Save.

HTTPS starts immediately, without restarting the service. HTTP stays as it is, on its own port: apps and players that use it notice nothing.

At the top right of the section you see the status: listening on 33443, off or won’t start — in that case the message underneath says why (for example, the port is used by another program).

Connections use TLS 1.3 (TLS 1.2 for older clients) and HTTP/2, kept open between requests: a player or a server pulling HLS does not open a new TLS connection for every segment.

Certificate

There are three kinds of certificate. In short:

The server’s own certificate

Castreon creates its own certificate and key (ECDSA P-256). The key stays on the server, in the data folder (tls/server.key), accessible only to the service.

• Names and addresses in the certificate — the server's domain or public IP, one per line. They are suggested from Public domain.
• The certificate is valid for one year and renews itself 30 days before expiry, with the same key — so the fingerprint stays the same. Servers that pull from here never need to be changed.
• New key creates a new key (new fingerprint) and closes open connections. Use it only if the old key may be compromised: servers that pull from here need the new fingerprint.

The server's own certificate is suited to use between your own servers. A browser does not recognise it and shows a warning — for the panel opened in a browser, or for the web player on a website, use a certificate issued by an authority (below).

Automatic Let's Encrypt

Castreon requests the certificate from Let's Encrypt by itself and renews it by itself — no certbot, nothing extra to install. The certificate is recognised by all browsers, players, TVs and apps.

1. Choose Automatic Let's Encrypt.
2. Domains of the server — for example tv.exemplu.ro, one per line. Each one must point to this server in DNS (the A / AAAA record). IP addresses cannot be entered here.
3. Email address (optional) — the authority only writes if something important comes up with the certificate.
4. Tick the acceptance of the Let's Encrypt terms and click Save.

To issue the certificate, Let's Encrypt checks from the internet that the domain is yours. One of these ports must reach the server:

• port 443 → Castreon's HTTPS port (for example 33443), or
• port 80 → Castreon's HTTP port (for example 33400).

The simplest way: a port forward in the router or the firewall. Castreon tries port 443 first, then port 80.

In the section you see the status: requesting the certificate, certificate issued (with the renewal date) or the reason it did not work — for example, the domain does not point to the server, or neither of the ports reaches Castreon. Castreon retries by itself, with longer and longer pauses (Let's Encrypt limits failed attempts); once you have fixed the problem, click Try now.

The certificate renews itself when a third of its validity is left (30 days on a 90-day certificate), without a restart.

Connections by IP still get the server's own certificate. Its fingerprint appears in the section, under For IP-based links between your servers, and does not change — fingerprint-pinned links between servers also work in automatic mode.

For unlimited attempts, choose the Let's Encrypt test environment under Authority (its certificates are not recognised by browsers). You can also use another ACME authority, for example a company-internal one.

Your own files (for example certbot)

If you already have a certificate from an authority:

• Certificate (fullchain) — for example /etc/letsencrypt/live/tv.exemplu.ro/fullchain.pem;
• Private key — for example /etc/letsencrypt/live/tv.exemplu.ro/privkey.pem.

The Castreon service must be able to read them. Castreon checks the files every minute and reloads them by itself when they change (after certbot renew), without a restart. If the new file is broken, the old certificate stays in use, and Settings → HTTPS tells you what is wrong.

HTTPS source with fingerprint (Castreon server → Castreon server)

The fingerprint is used only with the server's own certificate. A Let's Encrypt certificate (or one from another authority) gets a new key with every renewal, so its fingerprint would change every few weeks. For such a certificate, leave the fingerprint empty: the pulling server verifies it normally, against the authority.

On the server that sends (the station):

1. Turn on HTTPS and choose The server’s own certificate.
2. Copy the Fingerprint (pin) from Settings → HTTPS — it looks like sha256//….

On the server that pulls the channel:

1. Open the channel → Edit → source of type URL.
2. Address: the channel's HTTPS address, for example https://statie.exemplu.ro:33443/live/canal-1/index.m3u8?token=… (the section shows the exact address, with the token).
3. Right below the address, Certificate fingerprint (pin) appears: paste the copied fingerprint and click Save.

With a fingerprint, the connection is no longer made by ffmpeg but by Castreon:

• only the certificate with that fingerprint's key is accepted — any other certificate (another server, someone in the middle) is rejected, even if it is issued by an authority;
• each channel has its own connections, kept open between segments: on a busy line, a slow channel does not slow down the others;
• if something does not work, the reason appears in the channel log, for example: the certificate does not have the expected fingerprint, nobody is listening on the port, the port answers without TLS (it is the HTTP port).

Without a fingerprint, an https:// source works as before: the certificate is verified against the known authorities (Let's Encrypt and the others).

The fingerprint can also be checked from the command line: curl --pinnedpubkey 'sha256//…' -k https://statie.exemplu.ro:33443/healthz answers ok only with the correct fingerprint.

All of a server's sources on HTTPS, in one step

On a server that pulls many channels from one or more stations, there is no need to edit channel by channel. Under Settings → Sources from other Castreon servers there is one row for each server the channels pull from (/live/… addresses), with the number of channels and their status: HTTP, unencrypted, HTTPS with fingerprint, HTTPS (certificate from an authority) or mixed.

On a station's row:

1. HTTPS port of the source server — 33443 by default.
2. Fingerprint of the source server — copied from the station's Settings → HTTPS (the server's own certificate). Leave it empty only if the station has a certificate from an authority for the name in the address.
3. Move to HTTPS → confirm.

Castreon first checks the connection on one channel, exactly as the channels will make it — the fingerprint, the token, the allowed addresses, the port. If it does not work, it says why and changes nothing. If it works, it moves all of that station's sources to https://, with the port and the fingerprint, and running channels restart one by one, a second and a half apart — they do not all drop at once.

• After a New key on the station: paste the new fingerprint and click Update the sources.
• Back to HTTP returns the sources to HTTP, with the previous port.
• Each station has its own fingerprint; a backup source from another station keeps its own fingerprint.
• Every change appears in Audit, channel by channel.

Which port to use between servers

Any port works — security comes from TLS, the fingerprint, the token and the allowed addresses, not from the port number. Our recommendation:

• 443 on the outside, forwarded in the router to Castreon's HTTPS port (for example 33443): the link looks exactly like the traffic of any HTTPS website and gets through any network. On the pulling server, enter port 443.
• If the line does not allow incoming connections on 443, stay on 33443 — just as secure.
• Restrict access: on the station, set the Allowed addresses for /live (Settings → Stream access) to only the IPs of the servers that pull from it, and apply the same rule to the HTTPS port in the router or firewall.

Why HTTPS and not a tunnel

Direct HTTPS in Castreon is the standard used by CDNs and streaming origins: TLS 1.3 encryption (with new keys for every connection), server verification by certificate or fingerprint, and no extra programs between servers. A tunnel (VPN) also encrypts, but it is one more service to maintain, and it stops all traffic if it stops itself.

Frequently asked questions

Does HTTPS slow down delivery? Not noticeably: AES encryption on today's processors exceeds several gigabits per second per core, and connections kept open avoid the TLS handshake for every segment.

Can I use both HTTP and HTTPS? Yes. HTTP stays on its own port; move whatever you want to HTTPS, whenever you want.

What happens when the certificate is renewed? Nothing visible: new connections get the new certificate, open ones carry on. With the server's own certificate, the fingerprint stays the same.

Can I pin the fingerprint of a Let's Encrypt certificate? It is not recommended: its key changes on renewal, and the link would stop. The fingerprint is for the server's own certificate; a certificate from an authority is verified without a fingerprint.

Do access restrictions also apply over HTTPS? Yes — the token and the Allowed addresses for /live (Settings → Stream access) are the same over HTTP and HTTPS.