RTMPS Support?

[milbarge]

Hi,
Thank you for your work. I am interested in enabling SSL on RTMP streams. Is this something that is currently supported or in your road map, I can't find any references to it in your documentation? Thanks agin.

[arut]

SSL is not supported. You can pass the stream through an SSL proxy like stunnel etc. Supporting RTMPS is simple, so maybe I will do it.

[hazcod]

@arut , any plans to support this still?

[jessp01]

In case it helps others who need to get this done, here is how you can accomplish it using HAProxy.

Make sure you have HAProxy compiled with SSL support. It seems the official packages on several Linux distros are compiled without it [from licensing considerations, I suspect] and so, you may need to compile your own.
This can be done with these simple steps [replace 1.5.18 with whatever the latest stable happens to be at the time of reading this]:

# wget http://www.haproxy.org/download/1.5/src/haproxy-1.5.18.tar.gz
# tar zxvf haproxy-1.5.18.tar.gz
# cd haproxy-1.5.18
# make USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 USE_CRYPT_H=1 USE_LIBCRYPT=1
# make install

Config on a single machine running both Nginx with the RTMP module and HAProxy should be similar to:

frontend rtmp_https
         bind *:443 ssl crt /path/to/cert
         mode                    tcp
         log                     global
         maxconn                 $MAX_CONN_NUMBER_HERE
         timeout client          $CLIENT_TIMEOUT_HERE
         use_backend             rtmpbackend_tcp_ipvANY if
         default_backend         rtmpbackend_tcp_ipvANY


backend rtmpbackend_tcp_ipvANY
         mode                    tcp
         balance                 leastconn
         timeout connect         $CONNECTION_TIMEOUT_HERE
         timeout server          $SERVER_TIMEOUT_HERE
         retries                 3
         option                  httpchk GET /
         server                  rtmp-01 127.0.0.1:1935 check-ssl verify none

Of course, on a Production ENV, for redundancy, you'd ideally want several Nginx nodes and HAProxy should reside on a separate machine.

Frankly, while supporting RTMPs natively within the module could be nice, on Prod. ENVs you'll want it done with a load balancer and SSL offloading anyhow..

[jhaoheng]

Hi @jessp01

Thanks your answer.
And i meet some problem.

I use ffmpeg to push my streaming :

ffmpeg -re -i /Users/maxhu/Desktop/test.mp4 -vcodec libx264 -vprofile baseline -acodec aac -ar 44100 -strict -2 -ac 1 -f flv -s 1280x720 -q 10 "tls://localhost:443/demo/test?listen=1&cert={absolute_path}/ca.crt&key={absolute_path}/ca.key"

always return : Permission denied

but i sure the cert is correctly. use echo quit | openssl s_client -connect localhost:443 -CAfile ./ca.crt -key ./ca.key to check

[syberphunk]

@arut Sites such as Facebook are deprecating RTMP in favour of RTMPS. Please reconsider RTMPS support.

[jbo5112]

Deprecating? It will be disabled by Facebook on May 1, 2019.

[piyush008gupta]

ok it took me time to find how to make it work on windows with stunnel but i did i made a video so that any one can easily set it up heres a link-https://www.youtube.com/watch?v=e6JeRVI0ioQ

[AncientTom]

I tried to look at that video but his video is to hard to follow, and it isn't as easy setting stunnel up to act as a proxy for streaming rtmps to Facebook as he alleges. I have been working on this for over a day now without success. I have followed at least a half dozen different tutorials, which every one leaves out a lot of key information to make it work, and still can't get a ffmpeg stream connected to Facebook. My biggest problem using the stunnel proxy method is that there are 3 different apps involved in this; ffmpeg, stunnel, and Openssl, and stunnel is not outputting anything to the log file. This all makes troubleshooting impossible.

I have also tried to set up Hyproxy but I can't even get that to run. I had to compile it twice, the first time the version that is suggested in the above post wouldn't even compile with the current version of Openssl. I used the latest stable version and it then compiled properly but the instructions for setup in the above are also out of date and will not work with the current version.

After messing with this project for a while, I think that the greatest hope lies with stunnel but I am going to need help from someone more familiar with streaming with ffmpeg through a stunnel client.

Looking around the internet at streaming possibilities, I think that rtmp will be going out the same way http has in favor of everyone insisting on the secure solution. It would be sooo much better if nginx-rtmp also did rtmps directly instead of scluging up work arounds for future needs.

[cloudnull]

Just to add to the post, I published an article where I setup nginx+stunnel for multi-streaming to facebook and youtube, from OBS, on Windows using the WSL. Simple enough to follow / do if you're adventurous, or familiar with the CLI (Linux).