Custom Channel – x509: certificate signed by unknown authority

Channels DVR Server Troubleshooting
#1

I'm trying to add a live traffic camera as a custom channel to Channels. I'm picking one of the cameras from here: https://chart.maryland.gov/trafficcameras/index.php

They have the M3U file extension and it works without issue on a site like: Stream File Player and Tester (HLS/M3U8/RTMP/MP4 Player)

When I chose from a URL in the Custom Channels option, I got the following error:
invalid source url: Get "https://strmr5.sha.maryland.gov/rtplive/520119f4036b0075004d823633235daa/playlist.m3u8": x509: certificate signed by unknown authority

Any help would be appreciated!

Feature Request: Ability to add/use self-signed certificates for HLS streams in Custom Channels source
#2

Does it work if you change from https to http

#3

No. :frowning:

invalid source url: Get "https://strmr5.sha.maryland.gov:8443/rtplive/520119f4036b0075004d823633235daa/playlist.m3u8": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

#4

Try it again.
When I plugged it into VLC it gave a cert error.
I then opened it in Firefox to view the cert and it's signed by DigiCert.
I then plugged it into VLC again and it now plays.
vlcsnap-2022-01-16-16h24m18s435

#5

Still no dice, same error.

#6

Yah, could be the OS you're running the DVR server on doesn't trust the cert for some reason.
My Firefox and Edge on Windows 10 have no problem with the certificate.

#7

Thats's not http:
http: and https: both work for me
and where did port 8443 come from?

#8

Any change with latest prerelease?

#9

Nope, same error message.

#10

What about the new prerelease

#11

I tried with a couple of the cameras, same message:
invalid source url: Get "https://strmr5.sha.maryland.gov/rtplive/520119f4036b0075004d823633235daa/playlist.m3u8": x509: certificate signed by unknown authority

#12

Looking at the certificate for https://strmr5.sha.maryland.gov
Could the issue be the Root CA (DigiCert Global Root CA) signed the certificate using SHA-1?
And something no longer trusts SHA-1

I guess not. Appears root cert signing algorithms don't matter if they're in the trusted root store and not expired. Saw something about them being invalid though if not before date is 2014 or later.