Configure Client Certificates for Secure RTSP in FFmpeg

This article provides a quick guide on how to configure client certificates for secure RTSP (RTSPS) streams using FFmpeg. You will learn the exact command-line arguments required to authenticate your FFmpeg client using TLS certificates, ensuring a secure, encrypted connection to your streaming server.

Understanding RTSPS and Client Authentication

Secure RTSP (RTSPS) establishes a connection over TLS (Transport Layer Security). When a streaming server requires mutual TLS (mTLS) or client certificate authentication, the FFmpeg client must present a valid certificate and private key to verify its identity before the stream can be pulled or pushed.

Prerequisites

To configure secure RTSP, you need the following cryptographic files (typically in PEM format):

1. Client Certificate (client.crt): The certificate presented to the server.
2. Private Key (client.key): The private key corresponding to the client certificate.
3. CA Certificate (ca.crt) (Optional but recommended): The certificate authority file used to verify the streaming server’s identity.

FFmpeg Command Configuration

FFmpeg handles TLS connections using underlying libraries like GnuTLS, OpenSSL, or SecureTransport. You pass the certificate and key files directly as inputs using FFmpeg’s TLS options.

Here is the standard command structure to read a secure RTSP stream using client certificates:

ffmpeg -cert_file client.crt -key_file client.key -ca_file ca.crt -i rtsps://your-server-address:322/stream_path -c copy output.mp4

Parameter Breakdown

• -cert_file <path_to_cert>: Specifies the path to your client certificate (PEM format).
• -key_file <path_to_key>: Specifies the path to your client private key (PEM format).
• -ca_file <path_to_ca>: Specifies the certificate authority file to validate the server’s SSL/TLS certificate.
• -rtsp_transport tcp: (Optional) Forces FFmpeg to use TCP instead of UDP, which is highly recommended for stable TLS encapsulation.
• rtsps://: Specifies the secure RTSP protocol. Note that RTSPS typically uses port 322 or 8554, depending on your server configuration.

Streaming/Pushing an RTSP Stream with Certificates

If you are publishing a secure stream to an RTSP server that requires client authentication, the syntax is similar, but the certificate options are applied to the output:

ffmpeg -i input.mp4 -cert_file client.crt -key_file client.key -ca_file ca.crt -f rtsp -rtsp_transport tcp rtsps://your-server-address:322/live/stream

Troubleshooting Common Connection Issues

• File Format: Ensure both the certificate and the key are in PEM format. If you have a .pfx or .p12 file, you must extract the certificate and key using OpenSSL before passing them to FFmpeg.
• Permission Denied: Ensure the user running the FFmpeg command has read permissions for the certificate and key files.
• Verification Failures: If the server uses a self-signed certificate and you do not want to verify it, you can bypass verification by adding the -verify_peer_certs 0 option, though this is not recommended for production environments.