diff --git a/trunk/conf/full.conf b/trunk/conf/full.conf
index 5d1925fd8..e517a3b06 100644
--- a/trunk/conf/full.conf
+++ b/trunk/conf/full.conf
@@ -1100,6 +1100,26 @@ vhost hls.srs.com {
         # default: on
         hls_wait_keyframe       on;
 
+        # whether using AES encryption.
+        # default: off
+        hls_keys        on; 
+        # the number of clear ts which one key can encrypt.
+        # default: 10
+        hls_fragments_per_key 10;
+        # the hls key file name.
+        # we supports some variables to generate the filename.
+        #       [vhost], the vhost of stream.
+        #       [app], the app of stream.
+        #       [stream], the stream name of stream.
+        #       [seq], the sequence number of key corresponding to the ts.
+        hls_key_file     [app]/[stream]-[seq].key;
+        # the key output path.
+        # the key file is configed by hls_path/hls_key_file, the default is:
+        # ./objs/nginx/html/[app]/[stream]-[seq].key
+        hls_key_file_path    ./objs/nginx/html;
+        # the key root URL, use this can support https.
+        hls_key_url       https://localhost:8080;
+
         # on_hls, never config in here, should config in http_hooks.
         # for the hls http callback, @see http_hooks.on_hls of vhost hooks.callback.srs.com
         # @read https://github.com/ossrs/srs/wiki/v2_CN_DeliveryHLS#http-callback