How to Configure SSL for WSS Streaming in FFmpeg

This article explains how to configure SSL and TLS options when streaming over secure WebSockets (WSS) using FFmpeg. You will learn the essential command-line parameters needed to verify certificates, use custom Certificate Authorities (CA), and manage secure handshakes for encrypted streaming.

To stream via WSS, FFmpeg utilizes its underlying TLS protocol wrapper. This means you can control the SSL configuration of your WSS connection by passing specific TLS options directly in your FFmpeg command.

Basic WSS Stream Command

When streaming to a secure WebSocket endpoint, your output URL starts with wss://. By default, FFmpeg will attempt to verify the SSL certificate against your system’s default trust store.

ffmpeg -re -i input.mp4 -f mpegts wss://yourserver.com:443/stream

1. Disabling SSL Certificate Verification (For Testing)

During development or when working with self-signed certificates, you might need to bypass SSL verification. You can do this by setting the -tls_verify option to 0.

ffmpeg -re -i input.mp4 -f mpegts -tls_verify 0 wss://yourserver.com:443/stream

Warning: Disabling verification makes the connection vulnerable to man-in-the-middle attacks. Do not use this setting in production environments.

2. Using a Custom CA Certificate

If your WSS server uses a self-signed certificate or a certificate signed by an internal private Certificate Authority, you must provide the CA certificate to FFmpeg using the -ca_file parameter.

ffmpeg -re -i input.mp4 -f mpegts -tls_verify 1 -ca_file /path/to/ca_cert.pem wss://yourserver.com:443/stream

3. Configuring Client Certificate Authentication (mTLS)

If your WSS server requires mutual TLS (mTLS) authentication, you must present a client certificate and private key. Use the -cert_file and -key_file parameters to achieve this:

ffmpeg -re -i input.mp4 -f mpegts \
  -cert_file /path/to/client_cert.pem \
  -key_file /path/to/client_key.pem \
  wss://yourserver.com:443/stream

Key SSL Parameters Quick Reference