diff --git a/conf/lalserver.conf.json b/conf/lalserver.conf.json
index a3409e4..fc48af5 100644
--- a/conf/lalserver.conf.json
+++ b/conf/lalserver.conf.json
@@ -45,6 +45,10 @@
   "rtsp": {
     "enable": true,
     "addr": ":5544",
+    "rtsps_enable": true,
+    "rtsps_addr": ":5322",
+    "rtsps_cert_file": "./conf/cert.pem",
+    "rtsps_key_file": "./conf/key.pem",
     "out_wait_key_frame_flag": true,
     "auth_enable": false,
     "auth_method": 1,
diff --git a/pkg/base/url.go b/pkg/base/url.go
index 2ae13f0..ecf0bff 100644
--- a/pkg/base/url.go
+++ b/pkg/base/url.go
@@ -27,6 +27,7 @@ const (
 	DefaultHttpsPort = 443
 	DefaultRtspPort  = 554
 	DefaultRtmpsPort = 443
+	DefaultRtspsPort = 322
 )
 
 type UrlPathContext struct {
@@ -112,6 +113,8 @@ func ParseUrl(rawUrl string, defaultPort int) (ctx UrlContext, err error) {
 			defaultPort = DefaultRtspPort
 		case "rtmps":
 			defaultPort = DefaultRtmpsPort
+		case "rtsps":
+			defaultPort = DefaultRtspsPort
 		}
 	}
 
@@ -203,7 +206,7 @@ func ParseRtspUrl(rawUrl string) (ctx UrlContext, err error) {
 		return
 	}
 	// 注意，存在一种情况，使用rtsp pull session，直接拉取没有url path的流，所以不检查ctx.Path
-	if ctx.Scheme != "rtsp" || ctx.Host == "" {
+	if (ctx.Scheme != "rtsp" && ctx.Scheme != "rtsps") || ctx.Host == "" {
 		return ctx, fmt.Errorf("%w. url=%s", ErrInvalidUrl, rawUrl)
 	}
 
diff --git a/pkg/logic/config.go b/pkg/logic/config.go
index 26036bc..6f43c87 100644
--- a/pkg/logic/config.go
+++ b/pkg/logic/config.go
@@ -88,6 +88,10 @@ type HlsConfig struct {
 type RtspConfig struct {
 	Enable              bool   `json:"enable"`
 	Addr                string `json:"addr"`
+	RtspsEnable         bool   `json:"rtsps_enable"`
+	RtspsAddr           string `json:"rtsps_addr"`
+	RtspsCertFile       string `json:"rtsps_cert_file"`
+	RtspsKeyFile        string `json:"rtsps_key_file"`
 	OutWaitKeyFrameFlag bool   `json:"out_wait_key_frame_flag"`
 	rtsp.ServerAuthConfig
 }
diff --git a/pkg/logic/group__.go b/pkg/logic/group__.go
index 012d200..4bd7f28 100644
--- a/pkg/logic/group__.go
+++ b/pkg/logic/group__.go
@@ -10,10 +10,11 @@ package logic
 
 import (
 	"encoding/json"
-	"github.com/q191201771/lal/pkg/gb28181"
 	"strings"
 	"sync"
 
+	"github.com/q191201771/lal/pkg/gb28181"
+
 	"github.com/q191201771/lal/pkg/base"
 	"github.com/q191201771/lal/pkg/hls"
 	"github.com/q191201771/lal/pkg/httpflv"
@@ -569,7 +570,7 @@ func (group *Group) inSessionUniqueKey() string {
 }
 
 func (group *Group) shouldStartRtspRemuxer() bool {
-	return group.config.RtspConfig.Enable
+	return group.config.RtspConfig.Enable || group.config.RtspConfig.RtspsEnable
 }
 
 func (group *Group) shouldStartMpegtsRemuxer() bool {
diff --git a/pkg/logic/server_manager__.go b/pkg/logic/server_manager__.go
index f564c91..e56b823 100644
--- a/pkg/logic/server_manager__.go
+++ b/pkg/logic/server_manager__.go
@@ -42,6 +42,7 @@ type ServerManager struct {
 	rtmpServer    *rtmp.Server
 	rtmpsServer   *rtmp.Server
 	rtspServer    *rtsp.Server
+	rtspsServer   *rtsp.Server
 	httpApiServer *HttpApiServer
 	pprofServer   *http.Server
 	exitChan      chan struct{}
@@ -133,6 +134,9 @@ Doc: %s
 	if sm.config.RtspConfig.Enable {
 		sm.rtspServer = rtsp.NewServer(sm.config.RtspConfig.Addr, sm, sm.config.RtspConfig.ServerAuthConfig)
 	}
+	if sm.config.RtspConfig.RtspsEnable {
+		sm.rtspsServer = rtsp.NewServer(sm.config.RtspConfig.RtspsAddr, sm, sm.config.RtspConfig.ServerAuthConfig)
+	}
 	if sm.config.HttpApiConfig.Enable {
 		sm.httpApiServer = NewHttpApiServer(sm.config.HttpApiConfig.Addr, sm)
 	}
@@ -250,6 +254,17 @@ func (sm *ServerManager) RunLoop() error {
 		}()
 	}
 
+	if sm.rtspsServer != nil {
+		if err := sm.rtspsServer.ListenWithTLS(sm.config.RtspConfig.RtspsCertFile, sm.config.RtspConfig.RtspsKeyFile); err != nil {
+			return err
+		}
+		go func() {
+			if err := sm.rtspsServer.RunLoop(); err != nil {
+				Log.Error(err)
+			}
+		}()
+	}
+
 	if sm.httpApiServer != nil {
 		if err := sm.httpApiServer.Listen(); err != nil {
 			return err
@@ -327,10 +342,18 @@ func (sm *ServerManager) Dispose() {
 		sm.rtmpServer.Dispose()
 	}
 
+	if sm.rtmpsServer != nil {
+		sm.rtmpsServer.Dispose()
+	}
+
 	if sm.rtspServer != nil {
 		sm.rtspServer.Dispose()
 	}
 
+	if sm.rtspsServer != nil {
+		sm.rtspsServer.Dispose()
+	}
+
 	if sm.httpServerManager != nil {
 		sm.httpServerManager.Dispose()
 	}
diff --git a/pkg/rtsp/auth.go b/pkg/rtsp/auth.go
index 254b7e0..d6602c0 100644
--- a/pkg/rtsp/auth.go
+++ b/pkg/rtsp/auth.go
@@ -12,9 +12,10 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
-	"github.com/q191201771/lal/pkg/base"
 	"strings"
 
+	"github.com/q191201771/lal/pkg/base"
+
 	"github.com/q191201771/naza/pkg/nazamd5"
 )
 
@@ -45,7 +46,7 @@ func (a *Auth) ParseAuthorization(authStr string) (err error) {
 	switch {
 	case strings.HasPrefix(authStr, "Basic "):
 		a.Typ = AuthTypeDigest
-		authBase64Str := strings.TrimLeft(authStr, "Basic ")
+		authBase64Str := strings.TrimPrefix(authStr, "Basic ")
 
 		authInfo, err := base64.StdEncoding.DecodeString(authBase64Str)
 		if err != nil {
@@ -62,7 +63,7 @@ func (a *Auth) ParseAuthorization(authStr string) (err error) {
 	case strings.HasPrefix(authStr, "Digest "):
 		a.Typ = AuthTypeDigest
 
-		authDigestStr := strings.TrimLeft(authStr, "Digest ")
+		authDigestStr := strings.TrimPrefix(authStr, "Digest ")
 		a.Username = a.getV(authDigestStr, `username="`)
 		a.Realm = a.getV(authDigestStr, `realm="`)
 		a.Nonce = a.getV(authDigestStr, `nonce="`)
diff --git a/pkg/rtsp/server.go b/pkg/rtsp/server.go
index fa0a117..3fac360 100644
--- a/pkg/rtsp/server.go
+++ b/pkg/rtsp/server.go
@@ -9,6 +9,7 @@
 package rtsp
 
 import (
+	"crypto/tls"
 	"net"
 )
 
@@ -81,6 +82,19 @@ func (s *Server) Listen() (err error) {
 	return
 }
 
+func (s *Server) ListenWithTLS(certFile, keyFile string) (err error) {
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return
+	}
+	tlsConfig := &tls.Config{Certificates: []tls.Certificate{cert}}
+	if s.ln, err = tls.Listen("tcp", s.addr, tlsConfig); err != nil {
+		return
+	}
+	Log.Infof("start rtsps server listen. addr=%s", s.addr)
+	return
+}
+
 func (s *Server) RunLoop() error {
 	for {
 		conn, err := s.ln.Accept()