Broadcaster on Windows: ZEN Master shows "authorization plugin error ... was not OK (60)"
ERROR
In ZEN Master, the Broadcaster raises an authorization alert (you may see it as either an Error or a Warning - they are the same issue):
Broadcaster authorization plugin error: SSL peer certificate or SSH remote key was not OK (60)In the Broadcaster log you will see the following line (logging set to Warning for HTTP Upload or higher):
curl_easy_perform failed (60): SSL peer certificate or SSH remote key was not OK (60)
ISSUE
A ZEN Master–managed Broadcaster authorizes streams by making a secure (HTTPS) call back to ZEN Master. To trust that connection, the Broadcaster on Windows relies on the certificates in the Windows Trusted Root Certification Authorities store.
ZEN Master's certificate is issued by Amazon and its trust chain requires the Amazon Root CA 1 certificate. If that root is not present in the Windows root store, the Broadcaster cannot verify the connection and the authorization call fails with error 60 on every attempt.
Important: A web browser or a PowerShell Invoke-WebRequest test to the same address will usually succeed even when the Broadcaster fails, because Windows and browsers validate certificates differently than the Broadcaster does. A successful browser test does not rule out this issue, trust the Broadcaster's own log.
This issue is not caused by an expired certificate or an incorrect system clock.
RESOLUTION
Install the Amazon Root CA 1 certificate into the Windows root store, then restart the Broadcaster. Run all commands in an elevated (Administrator) PowerShell on the Broadcaster host.
- Confirm the root is missing
Get-ChildItem Cert:\LocalMachine\Root |
Where-Object { $_.Subject -match "Amazon Root CA 1|Starfield Services" } |
Select-Object Subject, ThumbprintIf Amazon Root CA 1 is not listed (you may see only "Starfield Services Root Certificate Authority - G2"), continue.
- Install Amazon Root CA 1
Option A: Download the certificate from Amazon's official repository and import it
# Download:
curl.exe -o AmazonRootCA1.cer https://www.amazontrust.com/repository/AmazonRootCA1.cer
# Import into the Windows root store:
Import-Certificate -FilePath .\AmazonRootCA1.cer -CertStoreLocation Cert:\LocalMachine\RootOption B: Capture the certificate directly from the ZEN Master connection and install it
$certs = @()
$cb = [Net.Security.RemoteCertificateValidationCallback]{
param($s,$c,$chain,$e); $script:certs = @($chain.ChainElements | ForEach-Object { $_.Certificate }); $true }
$tcp = New-Object Net.Sockets.TcpClient; $tcp.Connect("zen.zixi.com",443)
$ssl = New-Object Net.Security.SslStream($tcp.GetStream(),$false,$cb)
try { $ssl.AuthenticateAsClient("zen.zixi.com",$null,[Security.Authentication.SslProtocols]::Tls12,$false) } catch {}
$ssl.Dispose(); $tcp.Close()
$amazon = $script:certs | Where-Object { $_.Subject -match "CN=Amazon Root CA 1" } | Select-Object -First 1
$store = New-Object Security.Cryptography.X509Certificates.X509Store("Root","LocalMachine")
$store.Open("ReadWrite")
if ($amazon) { $store.Add($amazon) }
$store.Close()
Confirm it is now present by re-running the Step 1 command — you should now see Amazon Root CA 1 listed.
- Restart the Broadcaster
The (60) errors should no longer appear, and the authorization alert in ZEN Master will clear within a few minutes.