Encrypted ingest (RTMPS and SRT)
Your encoder sends each broadcast to Cardinal over RTMPS: RTMP inside a TLS connection, the same encryption a web browser uses. The video and the stream key are encrypted from your encoder to our ingest servers. Plain RTMP is not accepted, because it would send the stream key in clear text, where anyone on the same network could copy it and broadcast as you.
What to enter
Section titled “What to enter”The address goes in two fields, exactly as the stream shows them:
| Field | Example |
|---|---|
| Server | rtmps://ingest.cardinalstreaming.com:443/live |
| Stream key | 1846bdac…?key=strmi_… |
The stream key is the stream’s id with its ingest key attached. The ingest key on its own is refused. Treat the stream key like a password; if it leaks, make a new one from the stream’s page and the old one stops working at once.
If your encoder can’t connect
Section titled “If your encoder can’t connect”- Use the
rtmps://server, including:443. An encoder pointed at anrtmp://address can’t connect. - Update the encoder’s firmware or software. RTMPS needs TLS 1.2 or later, which encoders added years ago (OBS in version 22, vMix in version 21, the ATEM Mini Pro and Extreme in firmware 8.6.1).
- Check the network allows port 443. It is the port the web uses, so a network that allows web browsing almost always allows it.
SRT, encrypted
Section titled “SRT, encrypted”Encoders that support SRT can use it instead of RTMPS. SRT copes better with a shaky internet connection and recovers faster if one of our servers fails. With Cardinal it is encrypted only: each stream has its own passphrase, and a connection without it – or with the wrong one – is refused.
The stream shows, beside its stream key:
| Field | Example |
|---|---|
| SRT URL | srt://ingest.cardinalstreaming.com:8890?streamid=publish:live/1846bdac…&passphrase=…&pbkeylen=32 |
| SRT server | srt://ingest.cardinalstreaming.com:8890 |
| Stream ID | publish:live/1846bdac… |
| Passphrase | 32 letters and numbers |
- One address (OBS): paste the SRT URL into Server and leave Stream Key empty. It carries the Stream ID, the passphrase and AES-256 encryption.
- Separate fields (hardware encoders): host
ingest.cardinalstreaming.com, port8890, mode Caller; the Stream ID; and the passphrase, with encryption set to AES-256 (AES-128 works too).
The Stream ID names the stream and carries no key: it is sent before encryption starts, so nothing secret goes in it. The passphrase is the credential. Like the stream key it is shown once; making a new stream key gives a new passphrase too, and an encoder still using the old one is disconnected.
If an SRT encoder can’t connect:
- Check encryption is on and the passphrase is pasted whole.
- Check the Stream ID is exactly as shown, with nothing added after it.
- Check the network allows outgoing UDP to port 8890. SRT uses UDP; if the network blocks it, use RTMPS on port 443 instead.