This article provides a guide for Enabling LetsEncrypt SSL for AzuraCast VPS.

Enabling HTTPS with LetsEncrypt

Automatic LetsEncrypt setup and renewal are only available in the Docker installation. For other installation types, you can directly use Certbot.

LetsEncrypt is a free and simple way to allow safe and secure connections to your AzuraCast VPS installation. With a valid SSL certificate, you can:

• Secure your connection to AzuraCast when administering your stations,

• Enforce security for all AzuraCast administrators via HTTP Strict Transport Security (HSTS), and

• Provide a secure listening endpoint to listeners, avoiding "Mixed Content" warnings when your radio signal is played from a secure web page.

Important Considerations

Before setting up LetsEncrypt, you should make sure the following conditions are met:

• AzuraCast must be on its own domain or subdomain. You can't set up LetsEncrypt using only an IP address; you must have a domain (i.e. mysite.com) or a subdomain (radio.mysite.com) set up to point to your AzuraCast installation.

• AzuraCast's web server must be served on the default ports, 80 for HTTP and 443 for HTTPS. By default, AzuraCast is already set up this way, but if you've modified the ports to serve the site on a secondary port, you must switch the ports back to the defaults when setting up LetsEncrypt and when performing renewals.

Enabling LetsEncrypt

Connect to your host server via a terminal (SSH) connection and execute the following commands:

cd /var/azuracast
./docker.sh update-self
./docker.sh letsencrypt-create

Answer the prompts as shown to complete the setup process.

Renewing a Let's Encrypt Certificate

The web service will automatically renew your LetsEncrypt certificates. If you provide an e-mail in the initial setup process, that e-mail will be used to send you reminders of upcoming expiration in the event that automatic renewal fails.

What to do when Let's Encrypt is not working

The first thing that you should do when you have set up Let's Encrypt as described above and you still see AzuraCast serving a self-signed certificate is to restart AzuraCast via the following commands:

docker-compose down
docker-compose up -d

After starting AzuraCast, wait a few minutes just to be sure that everything has started up correctly then check if AzuraCast is still serving the self-signed certificate.

If it is still serving the self-signed certificate, take a look into the logs of the web container to see if there are any errors related to retrieving or renewing the certificate:

docker-compose logs -f web

Using a Custom Certificate

If you have a custom SSL certificate on your host, you should create a docker-compose.override.yml file in your /var/azuracast directory on the host server with the contents below, modified to reflect your domain name and the path to your SSL certificate and key:

services:
  web:
    volumes:
      - /path/on/host/to/ssl.crt:/etc/nginx/certs/ssl.crt:ro
      - /path/on/host/to/ssl.key:/etc/nginx/certs/ssl.key:ro

  stations:
    volumes:
      - /path/on/host/to/ssl.crt:/etc/nginx/certs/ssl.crt:ro
      - /path/on/host/to/ssl.key:/etc/nginx/certs/ssl.key:ro

Please note that Icecast expects an RSA private key as well as a certificate file with the complete certificate chain. For custom certificates in the .pem format generated by something like Certbot you will need to convert them like this:
openssl rsa -in privkey.pem -out example.com.key
openssl crl2pkcs7 -nocrl -certfile fullchain.pem | openssl pkcs7 -print_certs -out example.com.crt

Finally you need to restart AzuraCast in order to apply the changes:

docker-compose down
docker-compose up -d

When the server boots, your Let's Encrypt SSL certificate will be installed and connection attempts should automatically be forwarded for SSL-enabled ports. Additionally, the certificate should be renewed and replaced automatically every 60 days.