Expose the right socket and configure TLS

The hostname in a playlist and the address on which a process listens solve different problems. <hostname> describes the server to clients and directories. A socket’s <bind-address> selects a local interface. Neither setting configures DNS, routing, a firewall or a certificate.

Keep a local baseline

Start with 127.0.0.1 for a local test. For remote access, choose the intended interface and assess IPv4 and IPv6 independently. Omitting the bind address can expose more interfaces than expected. A correct A record does not prove that an AAAA route works, and a successful request on the server itself does not prove external reachability.

The following is a 2.5.0 excerpt inside <icecast>, not a complete file. Add or adjust one socket and merge the TLS context into the existing security block:

<listen-socket>
  <port>8443</port>
  <tls>auto_no_plain</tls>
</listen-socket>
<security>
  <tls-context>
    <tls-certificate>/ABSOLUTE/PATH/fullchain.pem</tls-certificate>
    <tls-key>/ABSOLUTE/PATH/private-key.pem</tls-key>
  </tls-context>
</security>

The paths are replacement values. The service account needs access to the certificate and private key, while unrelated users must not read the key. TLS also depends on how Icecast was built. The 2.5.0 example uses a security TLS context; older instructions put certificate paths under <paths>. Do not combine those forms indiscriminately.

Verify the public identity

curl --head --show-error https://stream.example.org:8443/status.xsl

Replace the example host with your own test server. Check the certificate name, validity and chain as well as the HTTP response. A certificate failure is a finding to fix, not a reason to adopt a permanent certificate-verification bypass. If a private test CA is intentional, supply its trusted CA file with curl’s --cacert option.

Treat compatibility ports separately

A Shoutcast-compatible source socket reserves the configured base port and the next port. That is not a generic recipe for an ordinary Icecast source. Confirm the encoder’s actual protocol before opening an extra port. Limit administration reachability through an explicit network policy and use encrypted transport when credentials cross the network.