From f52a63858ca48ce5d0134bb19d2851575343e226 Mon Sep 17 00:00:00 2001 From: Alessandro Ros Date: Fri, 3 Apr 2026 22:04:20 +0200 Subject: [PATCH] docs: add instructions on how to use encryption with OBS Studio (#5636) --- docs/2-publish/17-obs-studio.md | 82 ++++++++++++++++++++++- docs/4-other/24-rtmp-specific-features.md | 2 +- 2 files changed, 81 insertions(+), 3 deletions(-) diff --git a/docs/2-publish/17-obs-studio.md b/docs/2-publish/17-obs-studio.md index 85b963c3..1a778b1e 100644 --- a/docs/2-publish/17-obs-studio.md +++ b/docs/2-publish/17-obs-studio.md @@ -4,6 +4,8 @@ OBS Studio can publish streams to the server in several ways. The recommended on ## OBS Studio and RTMP +### Standard + In `Settings -> Stream` (or in the Auto-configuration Wizard), use the following parameters: - Service: `Custom...` @@ -27,7 +29,7 @@ If you want to generate a stream that can be read with WebRTC, open `Settings -> Then use the button `Start Recording` (instead of `Start Streaming`) to start streaming. -## OBS Studio and RTMP, multitrack video +### Multitrack video OBS Studio can publish multiple video tracks or renditions at once (simulcast). Make sure that the OBS Studio version is ≥ 31.0.0. Open `Settings -> Stream` and use the following parameters: @@ -109,8 +111,72 @@ Save the configuration and click `Start streaming`. The resulting stream will be available on path `/mystream`. +### Encryption (RTMPS) + +When publishing streams to _MediaMTX_ with RTMP, you can encrypt streams in transit by using the encrypted variant of RTMP (RTMPS). This can be enabled by using the `rtmps` scheme and the 1936 port: + +``` +rtmps://localhost:1936/mystream +``` + +Make sure that RTMP encryption is allowed in _MediaMTX_ (`rtmpEncryption: "optional"`). + +OBS Studio requires _MediaMTX_ to use a TLS certificate signed by a public certificate authority and silently rejects self-signed certificates. You can either buy a certificate from a public certificate authority or create a local certificate authority and use it to generate the server certificate and validate it on the OBS Studio machine, by following these instructions: + +1. Create the key pair of the local certificate authority: + + ```sh + openssl req \ + -x509 \ + -nodes \ + -days 3650 \ + -newkey rsa:4096 \ + -keyout myca.key \ + -out myca.crt \ + -subj "/O=myca/CN=myca" + ``` + +2. Use the key pair to create the server certificate. Replace `localhost` with the domain name OBS Studio will use to connect to the server: + + ```sh + openssl req \ + -newkey rsa:4096 \ + -nodes \ + -keyout server.key \ + -CA myca.crt \ + -CAkey myca.key \ + -subj "/CN=localhost" \ + -x509 \ + -days 3650 \ + -out server.crt + ``` + + You must use a domain name to connect to the server, not an IP address. If you do not have a domain name, edit the `/etc/hosts` file of the OBS Studio machine and associate a dummy domain name to the IP address of the server. + +3. Put the newly-generated `server.key` and `server.cert` on the _MediaMTX_ machine, in the same folder of the _MediaMTX_ executable, and check that the configuration points to them. + +4. Install the public key (`ca.crt`) of the local certificate authority on the OBS Studio machine. + + If you are using Linux, this can be accomplished with these commands: + + ```sh + sudo mkdir -p /usr/local/share/ca-certificates + sudo cp myca.crt /usr/local/share/ca-certificates/ + sudo update-ca-certificates + ``` + + WARNING: this will still not work when OBS Studio is installed with Flatpak, since Flatpak isolates OBS Studio from the host and prevents it from reading the `ca-certificates` folder. Install OBS Studio through another mean (snap / ppa / .deb). + + If you are using Windows, this can be accomplished with the command: + + ```sh + certutil -addstore "Root" myca.crt + ``` + ## OBS Studio and WebRTC +### Standard + Recent versions of OBS Studio can also publish streams to the server with the [WebRTC / WHIP protocol](04-webrtc-clients.md) Use the following parameters: - Service: `WHIP` @@ -120,7 +186,7 @@ Save the configuration and click `Start streaming`. The resulting stream will be available on path `/mystream`. -## OBS Studio and WebRTC, multitrack video +### Multitrack video OBS Studio can publish multiple video tracks or renditions at once (simulcast) with WebRTC / WHIP too. Make sure that the OBS Studio version is ≥ 32.1.0. Open `Settings -> Stream` and use the following parameters: @@ -133,3 +199,15 @@ Currently it's not possible to change resolution or bitrate (or canvas) of rendi Save the configuration and click `Start streaming`. The resulting stream will be available on path `/mystream`. + +### Encryption + +When publishing streams to _MediaMTX_ with WebRTC, you can encrypt the WebRTC handshake by using the HTTPS-based variant of WHIP. This can be enabled by using the `https` scheme: + +``` +https://localhost:8889/mystream +``` + +Make sure that WebRTC encryption is enabled in _MediaMTX_ (`webrtcEncryption: true`). + +OBS Studio requires _MediaMTX_ to use a TLS certificate signed by a public certificate authority and silently rejects self-signed certificates. You can either buy a certificate from a public certificate authority or create a local certificate authority and use it to generate the server certificate and validate it on the OBS Studio machine. Instructions are reported in [OBS Studio and RTMP, encryption (RTMPS)](#encryption-rtmps). diff --git a/docs/4-other/24-rtmp-specific-features.md b/docs/4-other/24-rtmp-specific-features.md index 3255ca92..c0157227 100644 --- a/docs/4-other/24-rtmp-specific-features.md +++ b/docs/4-other/24-rtmp-specific-features.md @@ -25,7 +25,7 @@ Streams can be published and read with the rtmps scheme and the 1937 port: rtmps://localhost:1937/... ``` -Be aware that RTMPS is currently unsupported by all major players. However, you can use a local _MediaMTX_ instance to decrypt streams before reading them, or alternatively a proxy like [stunnel](https://www.stunnel.org) or [nginx](https://nginx.org/). For instance, you can launch a local _MediaMTX_ instance with this configuration: +Be aware that RTMPS is currently unsupported by most major players. However, you can use a local _MediaMTX_ instance to decrypt streams before reading them, or alternatively a proxy like [stunnel](https://www.stunnel.org) or [nginx](https://nginx.org/). For instance, you can launch a local _MediaMTX_ instance with this configuration: ```yml paths: