How to Capture RTSPS Stream Using FFmpeg

Capturing an RTSP stream secured over TLS/SSL (known as RTSPS) is essential for recording or processing encrypted video feeds from modern IP cameras and streaming servers. This guide explains how to use FFmpeg to connect to an RTSPS endpoint, handle SSL/TLS certificate requirements, configure transport protocols, and save the resulting video stream to a local file efficiently without unnecessary re-encoding.

Understanding the RTSPS URL Format

RTSPS feeds use standard RTSP protocol mechanics encapsulated inside a TLS/SSL tunnel, typically operating over port 322 or 443. The general URL structure resembles:

rtsps://username:password@camera_ip_address:port/stream_path

Basic RTSPS Stream Capture

To capture the stream and save it directly to an MP4 container without re-encoding the video and audio, use the stream copy mode (-c copy). This preserves full quality and minimizes CPU usage:

ffmpeg -rtsp_transport tcp -i "rtsps://admin:password123@192.168.1.50:322/live" -c copy output.mp4

-rtsp_transport tcp: Forces TCP as the lower-level transport protocol, which reduces packet loss, frame corruption, and artifacts over secure connections.
-i "rtsps://...": Specifies the input URL. Always wrap the URL in quotes to prevent the shell from misinterpreting special characters.
-c copy: Copies the encoded video and audio streams directly into the target container.

Handling Self-Signed or Untrusted SSL Certificates

Many IP cameras and private streaming servers use self-signed certificates. By default, FFmpeg will reject these connections to prevent man-in-the-middle attacks. You can bypass certificate verification or provide a custom certificate authority (CA).

Disabling Certificate Verification

To skip TLS verification entirely, add the -tls_verify 0 flag before the input flag:

ffmpeg -tls_verify 0 -rtsp_transport tcp -i "rtsps://admin:password123@192.168.1.50:322/live" -c copy output.mp4

Specifying a Custom Certificate Authority

If you have the server's root certificate (ca.crt), specify it explicitly for a secure connection:

ffmpeg -ca_file /path/to/ca.crt -rtsp_transport tcp -i "rtsps://admin:password123@192.168.1.50:322/live" -c copy output.mp4

Common Practical Scenarios

1. Limiting the Recording Duration

To record a fixed duration of video (e.g., 60 seconds), use the -t option:

ffmpeg -tls_verify 0 -rtsp_transport tcp -i "rtsps://admin:password123@192.168.1.50:322/live" -t 60 -c copy capture_60s.mp4

2. Re-encoding for Wider Device Compatibility

If the source stream is H.265 (HEVC) and you require universal H.264 playback, re-encode the stream during capture:

ffmpeg -tls_verify 0 -rtsp_transport tcp -i "rtsps://admin:password123@192.168.1.50:322/live" -c:v libx264 -preset veryfast -crf 23 -c:a aac output_h264.mp4

3. Segmenting Recordings

To continuously save the stream in 15-minute chunks for surveillance archives:

ffmpeg -tls_verify 0 -rtsp_transport tcp -i "rtsps://admin:password123@192.168.1.50:322/live" -c copy -f segment -segment_time 900 -reset_timestamps 1 archive_%03d.mp4

Troubleshooting RTSPS in FFmpeg

TLS/OpenSSL Support: Ensure your FFmpeg build was compiled with SSL support (--enable-openssl or --enable-gnutls). Run ffmpeg -protocols and confirm that rtsps appears in the supported protocols list.
Packet Drops or Latency: If the connection drops frequently, increase the network buffer by adding -buffer_size 1024000 or -analyzeduration 10000000 before the input flag.