RTMS Node SDK: certificate verification on signaling and data connections

Realtime Media Streams
1

Hi everyone,

I’m using @zoom/rtms 1.1.0 on macOS arm64 with Node.js 24, receiving transcripts with is_verify_cert=1 and a valid CA bundle.

I found a thread confirming that disabling SSL verification is unnecessary. Could someone clarify the supported behavior for this configuration?

  • Do both signaling and data connections require TLS 1.2+, without plaintext fallback?

  • Do both reject untrusted certificate chains, hostname mismatches and expired certificates? Are additional settings required?

  • Where can I find bundled native-library security updates/backport information and the recommended package version?

Documentation or a pointer to the right technical contact would be very helpful. Thanks!

2

Your macOS arm64 + Node.js 24 setup is within Zoom’s currently documented support range, and @zoom/rtms 1.1.0 is the current published version.

The public docs do not currently prove the stronger guarantees you’re asking about. I can’t find an RTMS SDK specification stating that both signaling and media/data sockets enforce TLS 1.2+, prohibit plaintext fallback, or explicitly validate chain trust, hostname, and expiration identically.

For patching, Zoom’s public RTMS changelog records wrapper-level releases and some security fixes, but it does not expose a complete security/backport history for the bundled native libraries. I’d ask Developer Support for the native SDK version bundled with @zoom/rtms 1.1.0, its OpenSSL/libcurl versions, security-backport policy, and whether 1.1.0 is the recommended production build.

Recall.ai is a Zoom RTMS Preferred Partner, and you can get further RTMS integration support through Recall.ai if useful.

3

Thanks, Amanda - helpful to know you’re seeing the same documentation gap.

We’ve asked Marketplace Security to route this to the RTMS engineering team. If a Zoom maintainer can confirm the TLS/certificate checks on both connection types and point us to the bundled native-library security information, that would resolve our outstanding questions.

We’re using the SDK directly, so we’d prefer clarity on that supported path before considering another integration.

4

Hi @Charlos, @MaxM can chime in here as the SDK developer & maintainer.

Both signaling and media connections require TLS 1.2+.

We’re confused where the guidance that SSL verification is recommended disabled is coming from, we can’t find anywhere (yet?) in git history of samples where we show SSL verification should be disabled.

You can disable through the SDK wrapper, my understanding would be that this is to manage elsewhere/upstream or for testing during beta periods, but I’d like Max to weigh in (he’s out of office but will be back shortly).

5

Thanks, Michael - helpful to have confirmation that both signaling and media connections require TLS 1.2+.

Clarification: I wasn’t suggesting Zoom recommends disabling certificate verification. My original post referred to a thread confirming that disabling it was unnecessary. Sorry for the ambiguity.

We’re using @zoom/rtms 1.1.0 on macOS arm64 with Node.js 24, with is_verify_cert=1 and a valid CA bundle.

When Max is back, could he confirm whether that configuration rejects untrusted certificate chains, hostname mismatches and expired certificates on both signaling and media/data connections, and whether any additional settings are required?

A pointer to the bundled native-library security updates/backports and the recommended SDK version would also be appreciated.

Thanks for helping clarify the supported configuration :slight_smile: