TLS

TLS Certificate Verification Change in FFmpeg 9.x

Starting with FFmpeg 9.x, TLS peer certificate verification is enabled by default. In FFmpeg 8.x, HTTPS inputs could work even when the TLS backend did not have access to a valid CA certificate store, because certificate verification was not enabled by default.

This can expose platform-specific CA trust store issues. On some platforms (e.g. most Apple platforms), FFmpeg and its TLS backend may not automatically load the operating system CA certificate bundle or platform trust store. As a result, HTTPS URLs that previously worked may now fail during certificate verification.

Possible errors include:

[tls @ 0xb4007cee02cf5570] error:0A000086:SSL routines::certificate verify failed
https://filesamples.com/samples/image/webp/sample1.webp: I/O error

[tls @ 0x600002c34280] Peer certificate failed verification
https://filesamples.com/samples/image/webp/sample1.webp: Input/output error

Solutions

-tls_verify 0 can be used to revert back to FFmpeg 8.x behavior. This disables TLS peer certificate verification and is not recommended for production use.

The recommended approach is to provide a CA certificate bundle explicitly with -ca_file <path>. Test applications in the FFmpegKitNext Test repository include examples that place the Mozilla CA certificate bundle into the app and pass it to FFmpeg/FFprobe with -ca_file.

Examples:

• Android Test Application
• iOS Test Application
• Flutter Test Application
• Linux Test Application
• React Native Test Application
• Windows Test Application