diff --git a/clientconf.go b/clientconf.go
index 87534050..d3b84a6b 100644
--- a/clientconf.go
+++ b/clientconf.go
@@ -103,6 +103,11 @@ func (c ClientConf) Dial(scheme string, host string) (*ClientConn, error) {
 		return nil, fmt.Errorf("unsupported scheme '%s'", scheme)
 	}
 
+	v := StreamProtocolUDP
+	if scheme == "rtsps" && c.StreamProtocol == &v {
+		return nil, fmt.Errorf("RTSPS can't be used with UDP")
+	}
+
 	if !strings.Contains(host, ":") {
 		host += ":554"
 	}
@@ -122,6 +127,7 @@ func (c ClientConf) Dial(scheme string, host string) (*ClientConn, error) {
 	return &ClientConn{
 		conf:              c,
 		nconn:             nconn,
+		isTLS:             (scheme == "rtsps"),
 		br:                bufio.NewReaderSize(conn, clientReadBufferSize),
 		bw:                bufio.NewWriterSize(conn, clientWriteBufferSize),
 		udpRtpListeners:   make(map[int]*clientConnUDPListener),
diff --git a/clientconn.go b/clientconn.go
index f9876994..4c4ecb3d 100644
--- a/clientconn.go
+++ b/clientconn.go
@@ -65,6 +65,7 @@ func (s clientConnState) String() string {
 type ClientConn struct {
 	conf                  ClientConf
 	nconn                 net.Conn
+	isTLS                 bool
 	br                    *bufio.Reader
 	bw                    *bufio.Writer
 	session               string
@@ -386,6 +387,12 @@ func (c *ClientConn) Setup(mode headers.TransportMode, track *Track,
 	var rtpListener *clientConnUDPListener
 	var rtcpListener *clientConnUDPListener
 
+	// always use TCP if encrypted
+	if c.isTLS {
+		v := StreamProtocolTCP
+		c.streamProtocol = &v
+	}
+
 	proto := func() StreamProtocol {
 		// protocol set by previous Setup()
 		if c.streamProtocol != nil {
@@ -397,7 +404,7 @@ func (c *ClientConn) Setup(mode headers.TransportMode, track *Track,
 			return *c.conf.StreamProtocol
 		}
 
-		// try udp
+		// try UDP
 		return StreamProtocolUDP
 	}()