How to Capture RTSP over HTTPS Using FFmpeg

This article provides a practical guide on how to capture and record a secure Real-Time Streaming Protocol (RTSPS) stream using FFmpeg. You will learn the correct command-line syntax to connect to an RTSP stream over TLS/SSL, configure transmission protocols, and save the stream to a local video file without losing quality.

To capture an RTSPS stream, FFmpeg utilizes the rtsps:// schema instead of the standard rtsp:// schema. This forces FFmpeg to establish a secure connection using TLS/SSL.

The Basic Command Syntax

To capture an RTSPS stream and save it to a local MP4 file without re-encoding, use the following command:

ffmpeg -rtsp_transport tcp -i rtsps://username:password@server_address:port/stream_path -c copy output.mp4

Parameter Breakdown

• -rtsp_transport tcp: This option forces FFmpeg to use TCP as the underlying transport protocol. TCP is highly recommended for RTSPS because packet loss over UDP can corrupt the TLS handshake and interrupt the encrypted stream.
• -i rtsps://...: Specifies the input URL. Note the s in rtsps, which tells FFmpeg to use a secure connection (usually over port 322 or 8554). You must replace username, password, server_address, port, and stream_path with your actual stream credentials and address details.
• -c copy: This tells FFmpeg to copy the input video and audio streams directly to the output file without re-encoding. This process uses minimal CPU resources and preserves the original stream quality.
• output.mp4: The destination file where the captured stream will be saved.

Handling SSL/TLS Certificates

Because RTSPS relies on TLS, FFmpeg will attempt to verify the SSL certificate of the streaming server against your system’s trust store.

If your camera or streaming server uses a self-signed certificate, FFmpeg may reject the connection with a handshake error. For testing purposes, you can bypass certificate verification by adding the -tls_verify 0 parameter:

ffmpeg -tls_verify 0 -rtsp_transport tcp -i rtsps://username:password@server_address:port/stream_path -c copy output.mp4

Note: Disabling TLS verification exposes the connection to potential man-in-the-middle attacks. It should only be used in secure, private networks or for troubleshooting purposes.