Configure FFmpeg to Trust a Custom SSL CA

When streaming media over HTTPS using FFmpeg, private environments and internal networks often rely on custom or self-signed Certificate Authorities (CAs). By default, FFmpeg will reject these connections to prevent man-in-the-middle attacks, resulting in TLS handshake failures. This guide explains how to configure FFmpeg to trust a custom CA certificate directly via command-line flags, environment variables, or operating system trust stores.

Method 1: Use the `-ca_file` Flag

FFmpeg provides a built-in TLS option called -ca_file (or -cafile) to specify the path to a PEM-formatted CA certificate.

Because FFmpeg evaluates options in order, the -ca_file parameter must be placed before the HTTPS URL it applies to.

For HTTPS Input Streams:

ffmpeg -ca_file /path/to/custom-ca.pem -i https://internal-server.local/live/stream.m3u8 -c copy output.mp4

For HTTPS Output Streams:

ffmpeg -i input.mp4 -ca_file /path/to/custom-ca.pem -f flv https://internal-server.local/live/endpoint

Note: Ensure the certificate file is encoded in Base64 PEM format (typically ending in .pem or .crt).

Method 2: Set the `SSL_CERT_FILE` Environment Variable

Most pre-compiled FFmpeg binaries are linked against OpenSSL. OpenSSL natively respects the SSL_CERT_FILE environment variable, which tells the underlying network library where to locate your trusted CA bundle without modifying your FFmpeg command directly.

On Linux and macOS:

export SSL_CERT_FILE="/path/to/custom-ca.pem"
ffmpeg -i https://internal-server.local/live/stream.m3u8 -c copy output.mp4

On Windows (PowerShell):

$env:SSL_CERT_FILE="C:\path\to\custom-ca.pem"
ffmpeg -i https://internal-server.local/live/stream.m3u8 -c copy output.mp4

Method 3: Install the CA into the System Trust Store

If FFmpeg is running as part of an automated pipeline or service, the most robust solution is to install the custom CA directly into the host operating system's trusted root store. FFmpeg will automatically trust certificates recognized by the OS.

Ubuntu / Debian:

Copy the certificate to the CA directory:

sudo cp custom-ca.crt /usr/local/share/ca-certificates/

Update the store:
```
sudo update-ca-certificates
```

RHEL / CentOS / Rocky Linux:

Copy the certificate:

sudo cp custom-ca.crt /etc/pki/ca-trust/source/anchors/

Update the store:
```
sudo update-ca-trust
```

Insecure Fallback: Disabling Verification

If testing in a non-production environment where strict validation is temporarily not required, you can disable TLS certificate verification entirely using the -tls_verify 0 option:

ffmpeg -tls_verify 0 -i https://internal-server.local/live/stream.m3u8 -c copy output.mp4

Warning: Disabling TLS verification leaves the connection vulnerable to interception and should never be used in production.