diff --git a/configure b/configure
index 7201941c36..aff5bf3bc7 100755
--- a/configure
+++ b/configure
@@ -374,6 +374,8 @@ Advanced options (experts only):
                            disable buffer boundary checking in bitreaders
                            (faster, but may crash)
   --sws-max-filter-size=N  the max filter size swscale uses [$sws_max_filter_size_default]
+  --disable-tls-verify     disable verifying TLS certificates by default [autodetect]
+  --ca-bundle-path=PATH    path to the default trusted certificate authority list in PEM format [autodetect]
 
 Optimization options (experts only):
   --disable-asm            disable all assembly optimizations
@@ -1631,6 +1633,7 @@ FEATURE_LIST="
     small
     static
     swscale_alpha
+    tls_verify
 "
 
 LIBRARY_LIST="
@@ -2200,6 +2203,7 @@ CMDLINE_SET="
     build_suffix
     cc
     objcc
+    ca_bundle_path
     cpu
     cross_prefix
     custom_allocator
@@ -6593,6 +6597,25 @@ enabled lavfi_indev         && prepend avdevice_deps "avfilter"
 
 enabled opus_decoder    && prepend avcodec_deps "swresample"
 
+enabled_any tls_securetransport_protocol tls_schannel_protocol && enable_weak tls_verify
+enabled_any tls_openssl_protocol tls_gnutls_protocol && test -z ${ca_bundle_path+x} && {
+    for file in /etc/ssl/certs/ca-certificates.crt \
+                /etc/pki/tls/certs/ca-bundle.crt \
+                /usr/share/ssl/certs/ca-bundle.crt \
+                /usr/local/share/certs/ca-root-nss.crt \
+                ${prefix}/share/certs/ca-root-nss.crt \
+                /etc/ssl/cert.pem \
+                ${prefix}/share/curl/curl-ca-bundle.crt \
+                /usr/share/curl/curl-ca-bundle.crt \
+                /usr/local/share/curl/curl-ca-bundle.crt; do
+        if test -f "$file"; then
+            ca_bundle_path="$file"
+            break
+        fi
+    done;
+}
+enabled_any tls_openssl_protocol tls_gnutls_protocol && test -n "${ca_bundle_path}" && enable_weak tls_verify
+
 expand_deps(){
     lib_deps=${1}_deps
     eval "deps=\$$lib_deps"
@@ -6693,6 +6716,8 @@ echo "postprocessing support    ${postproc-no}"
 echo "network support           ${network-no}"
 echo "threading support         ${thread_type-no}"
 echo "safe bitstream reader     ${safe_bitstream_reader-no}"
+echo "TLS cert verification     ${tls_verify-no}"
+echo "CA bundle path            ${ca_bundle_path-none}"
 echo "texi2html enabled         ${texi2html-no}"
 echo "perl enabled              ${perl-no}"
 echo "pod2man enabled           ${pod2man-no}"
@@ -6909,6 +6934,10 @@ cat > $TMPH <<EOF
 #define SWS_MAX_FILTER_SIZE $sws_max_filter_size
 EOF
 
+test -n "$ca_bundle_path" &&
+    echo "#define CA_BUNDLE_PATH \"$(c_escape $ca_bundle_path)\"" >>$TMPH ||
+    echo "#define CA_BUNDLE_PATH NULL" >>$TMPH
+
 test -n "$assert_level" &&
     echo "#define ASSERT_LEVEL $assert_level" >>$TMPH
 
diff --git a/libavformat/tls.c b/libavformat/tls.c
index 10e0792e29..b1ce6529c8 100644
--- a/libavformat/tls.c
+++ b/libavformat/tls.c
@@ -64,6 +64,21 @@ int ff_tls_open_underlying(TLSShared *c, URLContext *parent, const char *uri, AV
 
     set_options(c, uri);
 
+    if (c->verify < 0) {
+        c->verify = CONFIG_TLS_VERIFY;
+#if CONFIG_TLS_VERIFY == 0
+        av_log(parent, AV_LOG_WARNING, "ffmpeg was configured without TLS verification enabled,\n"
+                                       "so this connection will be made insecurely.\n"
+                                       "To make this connection securely, enable the 'tls_verify' option%s"
+                                       ".\n",
+#if (CONFIG_TLS_GNUTLS_PROTOCOL || CONFIG_TLS_OPENSSL_PROTOCOL)
+                                       (CA_BUNDLE_PATH == NULL) ?
+                                       "\nand specify a path to a trusted-root bundle with the 'ca_file' option" :
+#endif
+                                       "");
+#endif
+    }
+
     if (c->listen)
         snprintf(opts, sizeof(opts), "?listen=1");
 
diff --git a/libavformat/tls.h b/libavformat/tls.h
index 53d0634f49..033d18c8db 100644
--- a/libavformat/tls.h
+++ b/libavformat/tls.h
@@ -45,9 +45,9 @@ typedef struct TLSShared {
 
 #define TLS_OPTFL (AV_OPT_FLAG_DECODING_PARAM | AV_OPT_FLAG_ENCODING_PARAM)
 #define TLS_COMMON_OPTIONS(pstruct, options_field) \
-    {"ca_file",    "Certificate Authority database file", offsetof(pstruct, options_field . ca_file),   AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
-    {"cafile",     "Certificate Authority database file", offsetof(pstruct, options_field . ca_file),   AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
-    {"tls_verify", "Verify the peer certificate",         offsetof(pstruct, options_field . verify),    AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, .flags = TLS_OPTFL }, \
+    {"ca_file",    "Certificate Authority database file", offsetof(pstruct, options_field . ca_file),   AV_OPT_TYPE_STRING, { .str = CA_BUNDLE_PATH }, .flags = TLS_OPTFL }, \
+    {"cafile",     "Certificate Authority database file", offsetof(pstruct, options_field . ca_file),   AV_OPT_TYPE_STRING, { .str = CA_BUNDLE_PATH }, .flags = TLS_OPTFL }, \
+    {"tls_verify", "Verify the peer certificate",         offsetof(pstruct, options_field . verify),    AV_OPT_TYPE_BOOL, { .i64 = -1 }, -1, 1, .flags = TLS_OPTFL }, \
     {"cert_file",  "Certificate file",                    offsetof(pstruct, options_field . cert_file), AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
     {"key_file",   "Private key file",                    offsetof(pstruct, options_field . key_file),  AV_OPT_TYPE_STRING, .flags = TLS_OPTFL }, \
     {"listen",     "Listen for incoming connections",     offsetof(pstruct, options_field . listen),    AV_OPT_TYPE_BOOL, { .i64 = 0 }, 0, 1, .flags = TLS_OPTFL }, \
