Configure SSL Verification in FFmpeg

This article provides a quick overview and practical guide on how to configure SSL/TLS certificate verification options in FFmpeg. When streaming or downloading media over secure HTTPS or TLS protocols, you may need to customize how FFmpeg validates security certificates. Below, you will find the direct command-line options required to enable, disable, or customize SSL certificate verification.

Disabling SSL Certificate Verification

In development or testing environments, you may encounter self-signed certificates or expired certificates that cause FFmpeg to block the connection. To bypass SSL verification, set the -tls_verify option to 0.

ffmpeg -tls_verify 0 -i https://your-secure-server.com/input.mp4 -c copy output.mp4

Note: Disabling SSL verification makes your connection vulnerable to man-in-the-middle attacks. Only use this option in trusted testing environments.

Enabling and Strict SSL Verification

By default, FFmpeg attempts to verify certificates using the system’s default trust store. To explicitly enforce certificate verification, set the -tls_verify option to 1.

ffmpeg -tls_verify 1 -i https://your-secure-server.com/input.mp4 -c copy output.mp4

Specifying a Custom Certificate Authority (CA) Bundle

If you are using a custom or private Certificate Authority, you must point FFmpeg to your CA certificate file. Use the -ca_file (or -cafile) option to define the path to your certificate bundle in PEM format.

ffmpeg -tls_verify 1 -ca_file /path/to/custom-ca-bundle.pem -i https://your-secure-server.com/input.mp4 -c copy output.mp4

Using Client Certificate Authentication

If the streaming server requires mutual TLS (mTLS) where the client must also present a certificate, you can configure your client certificate and private key using the -cert_file and -key_file options.

ffmpeg -tls_verify 1 \
  -cert_file /path/to/client-cert.pem \
  -key_file /path/to/client-key.pem \
  -i https://your-secure-server.com/input.mp4 \
  -c copy output.mp4