---
title: Broadcaster on Windows: ZEN Master shows "authorization plugin error ... was not OK (60)"
slug: troubleshooting/broadcaster-on-windows-zen-master-shows-authorization-plugin-error-was-not-ok-60
docTags: 
createdAt: 2026-07-15T10:07:56.941Z
---

### ERROR

In **ZEN Master**, the Broadcaster raises an authorization alert (you may see it as either an Error or a Warning - they are the same issue):

![](https://api.archbee.com/api/optimize/mzxtTQEvCNIdUNgF2kuwJ/4em88J-NNCQtviVeP1FAk_image.png)

```none
Broadcaster authorization plugin error: SSL peer certificate or SSH remote key was not OK (60)
```

In the **Broadcaster log** you will see the following line (logging set to Warning for HTTP Upload or higher):

```null
curl_easy_perform failed (60): SSL peer certificate or SSH remote key was not OK (60)
```



### ISSUE

A ZEN Master–managed Broadcaster authorizes streams by making a secure (HTTPS) call back to ZEN Master. To trust that connection, the Broadcaster on Windows relies on the certificates in the **Windows Trusted Root Certification Authorities store**.

ZEN Master's certificate is issued by Amazon and its trust chain requires the **Amazon Root CA 1** certificate. If that root is **not present** in the Windows root store, the Broadcaster cannot verify the connection and the authorization call fails with error **60** on every attempt.

**Important:** A web browser or a PowerShell Invoke-WebRequest test to the same address will usually succeed even when the Broadcaster fails, because Windows and browsers validate certificates differently than the Broadcaster does. A successful browser test does **not** rule out this issue, trust the Broadcaster's own log.

This issue is **not** caused by an expired certificate or an incorrect system clock.

### RESOLUTION

Install the **Amazon Root CA 1 **certificate into the Windows root store, then restart the Broadcaster. Run all commands in an **elevated (Administrator) PowerShell **on the Broadcaster host.

1. **Confirm the root is missing**

:::CodeblockTabs{indent="2"}
```powershell
Get-ChildItem Cert:\LocalMachine\Root |
  Where-Object { $_.Subject -match "Amazon Root CA 1|Starfield Services" } |
  Select-Object Subject, Thumbprint
```
:::

:::Paragraph{indent="2"}
If **Amazon Root CA 1 **is not listed (you may see only "Starfield Services Root Certificate Authority - G2"), continue.
:::

:::Paragraph{indent="3"}

:::

2. **Install Amazon Root CA 1**

:::Paragraph{indent="1"}
**Option A: **Download the certificate from Amazon's official repository and import it
:::

:::CodeblockTabs{indent="1"}
```powershell
# Download:
curl.exe -o AmazonRootCA1.cer https://www.amazontrust.com/repository/AmazonRootCA1.cer

# Import into the Windows root store:
Import-Certificate -FilePath .\AmazonRootCA1.cer -CertStoreLocation Cert:\LocalMachine\Root
```
:::

:::Paragraph{indent="1"}
**Option B: **Capture the certificate directly from the ZEN Master connection and install it
:::

:::CodeblockTabs{indent="1"}
```powershell
$certs = @()
$cb = [Net.Security.RemoteCertificateValidationCallback]{
    param($s,$c,$chain,$e); $script:certs = @($chain.ChainElements | ForEach-Object { $_.Certificate }); $true }
$tcp = New-Object Net.Sockets.TcpClient; $tcp.Connect("zen.zixi.com",443)
$ssl = New-Object Net.Security.SslStream($tcp.GetStream(),$false,$cb)
try { $ssl.AuthenticateAsClient("zen.zixi.com",$null,[Security.Authentication.SslProtocols]::Tls12,$false) } catch {}
$ssl.Dispose(); $tcp.Close()

$amazon = $script:certs | Where-Object { $_.Subject -match "CN=Amazon Root CA 1" } | Select-Object -First 1
$store = New-Object Security.Cryptography.X509Certificates.X509Store("Root","LocalMachine")
$store.Open("ReadWrite")
if ($amazon) { $store.Add($amazon) }
$store.Close()
```
:::

:::Paragraph{indent="1"}

:::

:::Paragraph{indent="1"}
Confirm it is now present by re-running the Step 1 command — you should now see **Amazon Root CA 1 **listed.
:::

:::Paragraph{indent="1"}

:::

3. **Restart the Broadcaster**

****

The (60) errors should no longer appear, and the authorization alert in ZEN Master will clear within a few minutes.