FFmpeg RTMPS Streaming with Client Certificates

To stream securely over RTMPS (RTMP over TLS/SSL) to a server that requires mutual TLS (mTLS) authentication, you must configure FFmpeg to present a client certificate and its corresponding private key. This article provides a direct guide on how to prepare your certificates and format the FFmpeg command line to establish a secure, authenticated connection.

Step 1: Prepare Your Certificates

FFmpeg requires certificates to be in the PEM format. You will need three files: 1. Client Certificate (client.crt or client.pem): The public certificate identifying your client. 2. Private Key (client.key): The private key associated with the client certificate. (For automated streaming, ensure this key is unencrypted/passwordless so FFmpeg can access it without user intervention). 3. CA Certificate (ca.crt, Optional but recommended): The Certificate Authority certificate used to verify the server’s identity.

Step 2: Configure the FFmpeg Command

FFmpeg provides specific options for the RTMP protocol to handle SSL/TLS connections. You can pass the client certificate and key using protocol-specific flags.

The standard command structure is as follows:

ffmpeg -re -i input.mp4 \
  -c:v libx264 -preset veryfast -b:v 3000k \
  -c:a aac -b:a 128k \
  -f flv \
  -rtmp_cert "/path/to/client.crt" \
  -rtmp_key "/path/to/client.key" \
  "rtmps://your-secure-server.com:443/live/stream_key"

Step 3: Alternative URL Query Configuration

If your build of FFmpeg does not recognize the -rtmp_cert and -rtmp_key command-line flags, you can pass the TLS parameters directly inside the RTMPS destination URL as query arguments.

ffmpeg -re -i input.mp4 \
  -c:v libx264 -c:a aac \
  -f flv \
  "rtmps://your-secure-server.com:443/live/stream_key?cert_file=/path/to/client.crt&key_file=/path/to/client.key"

Important Considerations

TLS Library Support: Ensure your FFmpeg binary was compiled with TLS support (typically via OpenSSL or GnuTLS). You can verify this by running ffmpeg -protocols and checking if rtmps is listed under output protocols.
Certificate Paths: When using the URL query parameter method on Windows, use forward slashes (/) for directory separators in the file paths to prevent parsing errors.
Strict Server Verification: If the server uses a self-signed certificate or a private CA, you must also pass the CA certificate to verify the server. Use the -rtmp_ca_file "/path/to/ca.crt" flag or append &ca_file=/path/to/ca.crt to the RTMPS URL.