> ## Documentation Index
> Fetch the complete documentation index at: https://red5.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure SSL for Red5 Pro: Let's Encrypt and Paid CAs

> Secure your Red5 Pro server with SSL using Let's Encrypt, DigiCert, or GoDaddy. HTTPS is required for WebRTC browser publishing and playback.

SSL is required for WebRTC. Browsers will not grant camera or microphone access to a page served over plain HTTP, and WebSocket connections used by WebRTC must be encrypted. This guide walks you through obtaining a certificate, converting it to a Java keystore, and configuring Red5 Pro to use it.

## Prerequisites

* A **DNS-resolvable domain name** pointing to your server's public IP address. Let's Encrypt will not issue a certificate for a raw IP address.
* **Port 80** open on your firewall during Let's Encrypt validation (you can close it again afterward).
* **Port 443** open for HTTPS and secure WebSocket traffic.
* OpenSSL and the Java `keytool` utility available on your server.
* Red5 Pro installed and stopped before you begin certificate conversion steps.

<Warning>
  The domain name must resolve correctly in DNS before you run certbot. If your DNS record has not propagated yet, certificate issuance will fail.
</Warning>

***

## Step 1: Obtain a certificate

<Tabs>
  <Tab title="Let's Encrypt (free)">
    Let's Encrypt provides free, automatically renewable certificates trusted by all major browsers. Certificates expire after 90 days and must be renewed.

    ### Install certbot

    <Tabs>
      <Tab title="Ubuntu / Debian">
        ```bash theme={null}
        sudo snap install core; sudo snap refresh core
        sudo snap install --classic certbot
        sudo ln -s /snap/bin/certbot /usr/bin/certbot
        ```
      </Tab>

      <Tab title="CentOS">
        ```bash theme={null}
        # CentOS 7
        sudo yum install epel-release
        # CentOS 8
        sudo dnf install epel-release && sudo dnf upgrade

        # Install and enable snapd
        sudo yum install snapd
        sudo systemctl enable --now snapd.socket
        sudo ln -s /var/lib/snapd/snap /snap
        ```

        Log out and back in to update your shell paths, then install certbot:

        ```bash theme={null}
        sudo snap install core; sudo snap refresh core
        sudo snap install --classic certbot
        sudo ln -s /snap/bin/certbot /usr/bin/certbot
        ```
      </Tab>
    </Tabs>

    ### Issue the certificate

    Stop Red5 Pro if it is running (certbot needs port 80), then run:

    ```bash theme={null}
    sudo certbot certonly --standalone \
      --email yourname@example.com \
      --agree-tos \
      -d ssl.example.com
    ```

    Replace `yourname@example.com` with your email address and `ssl.example.com` with your fully qualified domain name. You can add multiple domains with additional `-d` flags.

    If successful, certbot prints the certificate paths:

    ```text theme={null}
    IMPORTANT NOTES:
     - Congratulations! Your certificate and chain have been saved at
       /etc/letsencrypt/live/ssl.example.com/fullchain.pem.
       Your cert will expire on YYYY-MM-DD.
    ```

    <Note>
      Let's Encrypt certificates expire after 90 days. To renew, re-run the `certbot certonly` command above, then re-create the keystore and truststore files and restart Red5 Pro.
    </Note>

    ### Wildcard certificates

    If you need a single certificate to cover multiple subdomains (for example, nodes in an autoscaling cluster), use a DNS-challenge wildcard certificate instead:

    ```bash theme={null}
    certbot certonly --manual \
      --preferred-challenges=dns \
      --email yourname@example.com \
      --server https://acme-v02.api.letsencrypt.org/directory \
      --agree-tos \
      -d *.example.com
    ```

    Certbot will pause and ask you to create a `TXT` DNS record:

    ```text theme={null}
    Please deploy a DNS TXT record under the name
    _acme-challenge.example.com with the following value:

    qChEJ8PrVvhUEouNd3sypGuDYdMa63Dw8jy2cxJyKCs

    Before continuing, verify the record is deployed.
    ```

    Create the `TXT` record in your DNS provider's control panel. Wait for it to propagate (check with a DNS lookup tool), then press **Enter** to complete verification.
  </Tab>

  <Tab title="DigiCert (paid CA)">
    <Steps>
      <Step title="Generate a private key and keystore">
        When prompted for your first and last name, enter your **fully qualified domain name** (for example, `ssl.example.com`). For wildcard certificates, prefix with `*.` (for example, `*.example.com`).

        ```bash theme={null}
        keytool -keysize 2048 -genkey -alias tomcat \
          -keyalg RSA \
          -keystore keystore.jks \
          -storepass changeit
        ```
      </Step>

      <Step title="Generate a CSR">
        ```bash theme={null}
        keytool -certreq -keyalg RSA -alias tomcat \
          -file csr.txt \
          -keystore keystore.jks
        ```
      </Step>

      <Step title="Submit the CSR to DigiCert">
        Open `csr.txt` in a text editor, copy the full contents including the `BEGIN` and `END` tags, and paste them into the DigiCert web order form.
      </Step>

      <Step title="Download and install the certificate">
        Once DigiCert issues the certificate, download the `.p7b` file and import it into your keystore:

        ```bash theme={null}
        keytool -import -trustcacerts -alias tomcat \
          -file ssl_example_com.p7b \
          -keystore keystore.jks
        ```
      </Step>

      <Step title="Export the certificate for the truststore">
        ```bash theme={null}
        keytool -export -alias tomcat \
          -file tomcat.cer \
          -keystore keystore.jks \
          -storepass changeit \
          -noprompt
        ```
      </Step>

      <Step title="Create the truststore">
        ```bash theme={null}
        keytool -import -trustcacerts -alias tomcat \
          -file tomcat.cer \
          -keystore truststore.jks \
          -storepass changeit \
          -noprompt
        ```
      </Step>
    </Steps>
  </Tab>

  <Tab title="GoDaddy (paid CA)">
    <Steps>
      <Step title="Generate a private key and keystore">
        When prompted for your first and last name, enter your **fully qualified domain name** (for example, `ssl.example.com`). For wildcard certificates, use `*.example.com`.

        ```bash theme={null}
        keytool -keysize 2048 -genkey -alias tomcat \
          -keyalg RSA \
          -keystore keystore.jks \
          -storepass changeit
        ```
      </Step>

      <Step title="Generate a CSR">
        ```bash theme={null}
        keytool -certreq -keyalg RSA -alias tomcat \
          -file csr.txt \
          -keystore keystore.jks
        ```
      </Step>

      <Step title="Submit to GoDaddy">
        Submit the CSR at [certs.godaddy.com/cert](https://certs.godaddy.com/cert). Select **Tomcat** as the server type.
      </Step>

      <Step title="Download and import the certificate files">
        The GoDaddy ZIP contains three files. Import them in order:

        ```bash theme={null}
        # Root and cross-chain bundle
        keytool -import -alias root -keystore keystore.jks \
          -trustcacerts -file gd_bundle-g2-g1.crt \
          -storepass changeit -noprompt

        # Intermediate certificate
        keytool -import -alias intermed -keystore keystore.jks \
          -trustcacerts -file gdig2.crt \
          -storepass changeit -noprompt

        # Your issued site certificate
        keytool -import -alias tomcat -keystore keystore.jks \
          -trustcacerts -file 123abc678901def.crt \
          -storepass changeit -noprompt
        ```
      </Step>

      <Step title="Export the certificate for the truststore">
        ```bash theme={null}
        keytool -export -alias tomcat \
          -file tomcat.cer \
          -keystore keystore.jks \
          -storepass changeit \
          -noprompt
        ```
      </Step>

      <Step title="Create the truststore">
        ```bash theme={null}
        keytool -import -trustcacerts -alias tomcat \
          -file tomcat.cer \
          -keystore truststore.jks \
          -storepass changeit \
          -noprompt
        ```
      </Step>
    </Steps>
  </Tab>
</Tabs>

***

## Step 2: Create the Java keystore (Let's Encrypt only)

If you used Let's Encrypt, your certificate is in PEM format. You need to convert it to a Java KeyStore (JKS) before Red5 Pro's embedded Tomcat can use it.

<Steps>
  <Step title="Export to PKCS12">
    ```bash theme={null}
    sudo openssl pkcs12 -export \
      -in /etc/letsencrypt/live/ssl.example.com/fullchain.pem \
      -inkey /etc/letsencrypt/live/ssl.example.com/privkey.pem \
      -out /etc/letsencrypt/live/ssl.example.com/fullchain_and_key.p12 \
      -name tomcat
    ```

    Enter a password when prompted and note it — you will need it in the next command.

    <Warning>
      The alias **must** be `tomcat`. Red5 Pro's embedded Tomcat looks for this exact alias name in the keystore.
    </Warning>
  </Step>

  <Step title="Import into a JKS keystore">
    ```bash theme={null}
    sudo keytool -importkeystore \
      -deststorepass changeit \
      -destkeypass changeit \
      -destkeystore /etc/letsencrypt/live/ssl.example.com/keystore.jks \
      -srckeystore /etc/letsencrypt/live/ssl.example.com/fullchain_and_key.p12 \
      -srcstoretype PKCS12 \
      -srcstorepass changeit \
      -alias tomcat
    ```
  </Step>
</Steps>

***

## Step 3: Configure Red5 Pro

Open `conf/red5.properties` in your Red5 Pro installation directory and update the following properties:

### Set the HTTPS port

```properties theme={null}
http.port=5080
https.port=443
```

Using port 443 means clients do not need to specify a non-standard port when making HTTPS connections.

### Point to your keystore and truststore

```properties theme={null}
rtmps.keystorepass=changeit
rtmps.keystorefile=/etc/letsencrypt/live/ssl.example.com/keystore.jks
rtmps.truststorepass=changeit
rtmps.truststorefile=/etc/letsencrypt/live/ssl.example.com/truststore.jks
```

Replace `changeit` with the password you used when creating the keystore, and update the file paths to match where you stored your `.jks` files.

<Note>
  On Windows, use forward slashes in the path, for example:
  `rtmps.keystorefile=C:/letsencrypt/live/ssl.example.com/keystore.jks`
</Note>

### Enable SSL (Red5 Pro 14.0.0 and later)

Add or uncomment these two lines in `conf/red5.properties`:

```properties theme={null}
secure.enabled=true
websocket.enabled=true
```

<AccordionGroup>
  <Accordion title="Using a version earlier than 14.0.0?">
    Versions before 14.0.0 require you to modify `conf/jee-container.xml` in addition to `red5.properties`:

    1. Comment out the `<!-- Non-secured transports for HTTP and WS -->` section.
    2. Uncomment the `<!-- Secure transports for HTTPS and WSS -->` section.
    3. Save the file and restart Red5 Pro.
  </Accordion>
</AccordionGroup>

***

## Step 4: Restart and verify

```bash theme={null}
sudo systemctl restart red5pro
```

Then open a browser and navigate to `https://your-domain.com`. You should see the Red5 Pro landing page served over HTTPS with a valid certificate indicator in the browser address bar.

<Tip>
  After confirming SSL works, you can close port 80 on your firewall. Leave port 443 open for all HTTPS and WebSocket traffic.
</Tip>

***

## RTMPS (optional)

RTMPS is not required for WebRTC but is available if you need encrypted RTMP connections. To enable it, open `conf/red5-core.xml` and uncomment the `rtmpsMinaIoHandler` and `rtmpsTransport` bean definitions. RTMPS runs on port 8443 by default; the keystore settings in `red5.properties` under the `# RTMPS` section apply here as well.