I've discovered a setup that worked on Roku 1 (2.9) but not Roku 2 (4.1) with HLS.
Our setup uses a variant playlist (requested by https) with different bitrate streams, to then request the actual playlist (by https).
The actual playlist lists the .ts files, which are AES encrypted, and the key files are requested via https, but the media files are handled with straight http.
Our server is setup to perform mutual authentication, and our https server is set to trust the roku certificate authority.
The problem we are seeing is that the first variant playlist loads correctly, and gets past the mutual authentication phase. However on roku 2, the main playlist load will fail to get past the mutual authentication, and our server refuses to deliver the playlist to roku 2 (returns on error 403 - access forbidden). This worked fine on roku 1.
If I set the roku to play the second playlist via https directly, it authenticates fine, and plays the stream perfectly.
Here is the variant playlist (with only one stream to choose) - i've changed the ip of the server
#EXTM3U
#EXT-X-STREAM-INF:PROGRAM-ID=1, BANDWIDTH=1740800
https://8.8.8.8/hls/playlist/stream1.m3u8Here is the contents of stream1.m3u8
#EXTM3U
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:398
#EXT-X-KEY:METHOD=AES-128,URI="https://8.8.8.8/hls/keys/stream1_132.key"
#EXTINF:10,
http://8.8.8.8/hls/stream1_398.ts#EXTINF:10,
http://8.8.8.8/hls/stream1_399.ts#EXT-X-KEY:METHOD=AES-128,URI="https://8.8.8.8/hls/keys/stream1_133.key"
#EXTINF:10,
http://8.8.8.8/hls/stream1_400.ts#EXTINF:10,
http://8.8.8.8/hls/stream1_401.ts#EXTINF:10,
http://8.8.8.8/hls/stream1_402.ts#EXT-X-KEY:METHOD=AES-128,URI="https://8.8.8.8/hls/keys/stream1_134.key"
#EXTINF:10,
http://8.8.8.8/hls/stream1_403.ts#EXTINF:10,
http://8.8.8.8/hls/stream1_404.ts#EXTINF:10,
http://8.8.8.8/hls/stream1_405.ts#EXT-X-KEY:METHOD=AES-128,URI="https://8.8.8.8/hls/keys/stream1_135.key"
#EXTINF:10,
http://8.8.8.8/hls/stream1_406.ts#EXTINF:10,
http://8.8.8.8/hls/stream1_407.ts