{"id":82486,"date":"2026-09-23T09:32:29","date_gmt":"2026-09-23T12:32:29","guid":{"rendered":"https:\/\/a3aengenharia.com\/?post_type=articles&p=82486"},"modified":"2026-09-23T09:32:29","modified_gmt":"2026-09-23T12:32:29","slug":"secure-streaming-onvif-profile-t-https-rtsps-srtp","status":"publish","type":"articles","link":"https:\/\/a3aengenharia.com\/en-us\/content\/technical-articles\/secure-streaming-onvif-profile-t-https-rtsps-srtp\/","title":{"rendered":"Secure Streaming in ONVIF: Profile T, HTTPS, RTSPS, and SRTP"},"content":{"rendered":"\n

Secure Streaming, in the context of ONVIF Profile T<\/strong>, should be interpreted based on the transport function defined by the profile itself: streaming over RTP\/RTSP\/HTTPS\/TCP<\/strong>. In the Profile T v1.0 specification, published in September 2018, this function is classified as conditional<\/strong>. Therefore, a device’s conformity with Profile T does not, by itself, establish that it supports this protected streaming mode.<\/p>\n\n\n\n

This definition should also not be confused with SRTP \u2014 Secure Real-time Transport Protocol<\/strong>. In more recent ONVIF specifications, there is a distinct capability called SecureRTSPStreaming<\/code>, associated with RTSPS and SRTP<\/strong>. The difference is architectural: in the HTTPS streaming referenced by Profile T, protection is provided by TLS on the HTTPS channel<\/strong>; in modern SecureRTSPStreaming, RTSP control uses TLS and the media can be protected directly by SRTP.<\/p>\n\n\n\n

This distinction is especially important in design, technical specifications, procurement, and qualification of cameras and VMS platforms. Requiring only \u201cONVIF Profile T\u201d is not the same as requiring the HTTPS streaming feature; likewise, finding \u201cSecure Streaming\u201d in the conformity declaration of a Profile T product should not automatically be interpreted as proof of SRTP support.<\/p>\n\n\n\n\n

Why Does the Term Secure Streaming Cause Confusion in ONVIF?<\/h2>\n\n\n\n

\u201cSecure Streaming\u201d is an intuitive expression, but technically broad. Outside a normative context, it can be used to describe virtually any mechanism that protects a media stream in transit. Within the ONVIF ecosystem, however, it is necessary to identify which specification, profile, capability, or function<\/strong> is being considered.<\/p>\n\n\n\n

The first point is that Secure Streaming is not the name of a network protocol<\/strong>. The mechanisms used by ONVIF are built on existing protocols and services such as RTP, RTCP, RTSP, HTTP, HTTPS, TCP, UDP, TLS, and, in newer specifications, SRTP.<\/p>\n\n\n\n

The second point is that an ONVIF Profile is not a protocol either<\/strong>. A profile defines a fixed set of functions so that devices and clients from different manufacturers have a predictable interoperability baseline. The underlying functions are detailed in the ONVIF Network Interface Specifications.<\/p>\n\n\n\n

Therefore, three expressions that appear similar need to be kept separate:<\/p>\n\n\n\n

Expression<\/td>Technical meaning<\/td><\/tr>
ONVIF Profile T<\/strong><\/td>ONVIF profile for advanced IP video functions and interoperability between device and client<\/td><\/tr>
Streaming over RTP\/RTSP\/HTTPS\/TCP<\/strong><\/td>HTTPS\/TLS-protected transport function referenced by Profile T<\/td><\/tr>
SecureRTSPStreaming<\/strong><\/td>Newer Media2 capability for secure streaming via RTSPS and SRTP<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Mixing these three layers leads to specification errors. The most common is to state that \u201cProfile T Secure Streaming is SRTP.\u201d That statement does not match how Profile T v1.0 defines its secure-streaming function.<\/p>\n\n\n\n\n

What Does ONVIF Profile T Establish About Secure Streaming?<\/h2>\n\n\n\n

Profile T was published for IP-based video systems and includes functions related to H.264\/H.265, image configuration, events, metadata streaming, and other video capabilities. To understand Secure Streaming, however, the most important reference is Section 7.9 \u2014 Video streaming<\/strong> of the Profile T v1.0 specification.<\/p>\n\n\n\n

For a device, the specification establishes, among other requirements, support for streaming over RTP\/UDP<\/strong> and over RTP\/RTSP\/HTTP\/TCP<\/strong>. It then establishes that, if supported<\/strong>, the device should be capable of streaming video over RTP\/RTSP\/HTTPS\/TCP<\/strong> using the selected Media Profile.<\/p>\n\n\n\n

In the Profile T Function List, the distinction is explicit:<\/p>\n\n\n\n

Streaming function<\/td>Profile T device<\/td><\/tr>
Streaming over RTP\/UDP<\/td>M \u2014 Mandatory<\/strong><\/td><\/tr>
Streaming over RTP\/RTSP\/HTTP\/TCP<\/td>M \u2014 Mandatory<\/strong><\/td><\/tr>
Streaming over RTP\/RTSP\/HTTPS\/TCP<\/td>C \u2014 Conditional<\/strong><\/td><\/tr>
Streaming over RTP\/UDP Multicast<\/td>M \u2014 Mandatory<\/strong><\/td><\/tr>
Streaming over RTP\/RTSP\/TCP\/WebSocket<\/td>C \u2014 Conditional<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

For clients, Streaming over RTP\/RTSP\/HTTPS\/TCP<\/code> also appears as a conditional function<\/strong>.<\/p>\n\n\n\n

This produces an important practical consequence: Profile T and HTTPS streaming support are not equivalent<\/strong>. A product can conform to Profile T without this conditional function being present. When the design requirement is to actually use the protected stream, it is necessary to verify the conformity declaration and features applicable to the model and firmware<\/strong> being offered.<\/p>\n\n\n\n

What Does \u201cConditional\u201d Mean in Profile T?<\/h3>\n\n\n\n

The specification itself defines requirement levels. A conditional feature or function must be implemented according to ONVIF when the device or client supports that functionality under the conditions defined by the profile. It does not simply become mandatory for every Profile T product.<\/p>\n\n\n\n

This differs from a function marked as M \u2014 Mandatory<\/strong>, which forms part of the minimum required for the corresponding conformity.<\/p>\n\n\n\n

For specification engineering, this distinction is decisive. A statement such as \u201cthe equipment shall be ONVIF Profile T\u201d does not demonstrate compliance with every conditional capability in the profile.<\/p>\n\n\n\n\n

Before Security: How Is Video Streaming Organized?<\/h2>\n\n\n\n

To understand where HTTPS, TLS, and SRTP operate, it is necessary to separate encoding, transport, session control, and cryptographic protection<\/strong>.<\/p>\n\n\n\n

H.264 and H.265 are video coding formats. They define how visual information is compressed and represented, but they are not responsible for transporting video across the network or establishing a session between a camera and VMS.<\/p>\n\n\n\n

Real-time transport is normally performed by RTP \u2014 Real-time Transport Protocol<\/strong>The RTSP \u2014 Real Time Streaming Protocol<\/strong> is used to control the streaming session. In a simplified representation:<\/p>\n\n\n\n

Captured image \u2193 H.264 \/ H.265 \u2193 RTP \u2193 RTSP control \u2193 IP network<\/code><\/pre>\n\n\n\n
RTP \u2014 Media Transport<\/h3>\n\n\n\n
RTP organizes real-time media transmission. Its header includes information used to interpret the stream, such as sequence number, timestamp, and payload type. In IP video systems, it is the protocol that actually carries the media encapsulated according to the applicable formats.<\/p>\n\n\n\n
RTP by itself should not be treated as an encryption mechanism. A conventional RTP stream does not gain confidentiality simply because it is transported over a closed IP network.<\/p>\n\n\n\n
RTCP \u2014 Control Associated with RTP<\/h3>\n\n\n\n
RTCP is the control protocol associated with RTP and can carry quality and session-synchronization information. It should not be confused with RTSP.<\/p>\n\n\n\n
RTCP and RTSP are different protocols.<\/strong> RTCP accompanies RTP operation; RTSP is used to establish and control the streaming session.<\/p>\n\n\n\n
RTSP \u2014 Session Control<\/h3>\n\n\n\n
RTSP enables operations such as session establishment, description, playback, and termination. Methods such as DESCRIBE<\/code>, SETUP<\/code>, PLAY<\/code> and TEARDOWN<\/code> are part of this logic.<\/p>\n\n\n\n
Therefore, simply saying that \u201cRTSP transports the video\u201d is an imprecise simplification. In a conventional session, RTSP controls the session while RTP transports the media.<\/p>\n\n\n\n\n
Main Transport Methods Considered by ONVIF<\/h2>\n\n\n\n
The ONVIF Streaming Specifications describe different transport methods for different network scenarios.<\/p>\n\n\n\n
RTP over UDP<\/h3>\n\n\n\n
RTP can use UDP directly. This arrangement has low overhead and is particularly suited to the time-sensitive nature of audio and video, but it does not provide cryptographic confidentiality by itself.<\/p>\n\n\n\n
RTP \u2193 UDP \u2193 IP<\/code><\/pre>\n\n\n\n
Interleaved RTP over RTSP\/TCP<\/h3>\n\n\n\n
RTP media can also be transported within the TCP channel associated with RTSP using the interleaved binary-data mechanism.<\/p>\n\n\n\n
RTP \u2193 RTSP \/ TCP \u2193 IP<\/code><\/pre>\n\n\n\n
RTP\/RTSP over HTTP\/TCP<\/h3>\n\n\n\n
ONVIF also specifies tunneling via HTTP, traditionally useful for traversing environments in which HTTP traffic is more readily allowed through firewalls and proxies.<\/p>\n\n\n\n
RTP \u2193 RTSP \u2193 HTTP \u2193 TCP<\/code><\/pre>\n\n\n\n
RTP\/RTSP over HTTPS\/TCP<\/h3>\n\n\n\n
When this tunneling is performed over HTTPS, the HTTP connection is protected by TLS:<\/p>\n\n\n\n
Video \/ audio \/ metadata \u2193 RTP \u2193 RTSP \u2193 HTTP tunneling \u2193 HTTPS \u2193 TLS \u2193 TCP \u2193 IP<\/code><\/pre>\n\n\n\n
This is the arrangement \u2014 RTP\/RTSP\/HTTPS\/TCP<\/strong> \u2014 that should be associated with the conditional secure\/HTTPS streaming function in Profile T.<\/p>\n\n\n\n\n
Where Is the Security in RTP\/RTSP\/HTTPS\/TCP?<\/h2>\n\n\n\n
In the mechanism referenced by Profile T, protection does not result from transforming RTP into SRTP. It results from TLS used by HTTPS<\/strong>.<\/p>\n\n\n\n
In simplified terms, HTTPS can be understood as HTTP operating over a TLS session. TLS provides protection mechanisms for data traversing that channel, including confidentiality and integrity in transit, as well as endpoint-authentication mechanisms depending on the certificate and trust configuration used.<\/p>\n\n\n\n
This means the architectural model differs from protecting each RTP packet directly with SRTP.<\/p>\n\n\n\n
TLS Is Not an Encryption Algorithm<\/h3>\n\n\n\n
Another frequent mistake is treating TLS as synonymous with AES. TLS is a security protocol<\/strong> that establishes a protected session and negotiates the applicable cryptographic mechanisms. AES may be part of the cipher suites used, but it is not correct to define \u201cTLS = AES.\u201d<\/p>\n\n\n\n
Likewise, the mere presence of the term HTTPS should not be taken as proof of a specific cipher suite without verifying the TLS version and configuration actually used by the endpoints.<\/p>\n\n\n\n
Certificates and Trust<\/h3>\n\n\n\n
The security of a TLS session also depends on how the client validates the endpoint’s identity. Digital certificates, the trust chain, and validation policies are part of the design of a secure deployment.<\/p>\n\n\n\n
A self-signed certificate can provide encryption, but it requires a coherent trust model so that the client knows it is communicating with the intended device. In corporate environments, certificate management should be treated as part of the security architecture, not merely as a camera web-interface option.<\/p>\n\n\n\n\n
Profile T Secure Streaming Is Not Synonymous with SRTP<\/h2>\n\n\n\n
This is the most important distinction in this topic.<\/p>\n\n\n\n
In Profile T v1.0, the conditional secure-transport function is described as:<\/p>\n\n\n\n
Streaming over RTP\/RTSP\/HTTPS\/TCP<\/strong>.<\/p>\n\n\n\n
It is not described as \u201cSRTP.\u201d RTP media remains within the RTSP\/HTTP tunneling architecture while TLS protects the HTTPS channel.<\/p>\n\n\n\n
In a simplified representation:<\/p>\n\n\n\n
Profile T v1.0: TLS protects the HTTPS channel carrying RTP\/RTSP<\/title>