Video encryption FAQ

What is MtsHlsUriToken and how do I obtain it?

The MtsHlsUriToken parameter is a custom parameter. In standard HLS encryption, after the encryption string is written into the HLS stream, the address of a decryption server is added to the M3U8 manifest. To allow only specific users to access the video, the decryption server requires an identity authentication mechanism. The MtsHlsUriToken parameter adds an authentication layer to your decryption server. A special parameter is then generated based on this authentication logic and passed for decryption verification.

To configure encryption, set up a token issuance service that generates MtsHlsUriToken (Step 1 in HLS encryption).

How do I use the generated key?

The GenerateKMSDataKey operation returns a ciphertext key (CiphertextBlob) and a plaintext key (Plaintext). Pass only the ciphertext key to ApsaraVideo VOD, as specified in EncryptConfig: specifies the configurations for HLS encryption in SubmitTranscodeJobs.

How do I pass a token to the decryption service?

Use an Alibaba Cloud CDN domain name for playback. Pass the MtsHlsUriToken parameter when requesting an M3U8 address. The system automatically rewrites MtsHlsUriToken for the decryption service and sends the request.

How do I verify that an encrypted video plays correctly?

Use Alibaba Cloud Player Diagnostic Platform to test HLS-encrypted M3U8 playback. Enter the M3U8 URL and the MtsHlsUriToken value (if set) to verify decryption and playback.

Other FAQs

• API error message

  If SubmitTranscodeJobs returns KeyNotFound, contact ApsaraVideo VOD technical support to create a service key in the required region, such as China (Beijing) or China (Shanghai). The service key is used to generate encryption keys.

• Unencrypted file

  If the output file is not encrypted, go to your transcoding template and confirm that Video Encryption is enabled and Alibaba Cloud Proprietary Cryptography is selected.

• Custom key

  Custom strings cannot be used as encryption keys. Generate the plaintext key by calling GenerateKMSDataKey.

• Encryption failure

  If HLS encryption and transcoding fail with no output, verify that the key generated by GenerateKMSDataKey is of the AES_128 type.

• Decryption failure

  If an HLS-encrypted video fails to decrypt for playback, verify that the decryption service Base64-decodes the plaintext key returned by DecryptKMSDataKey before sending it to the player. If the plaintext key is not decoded, the decryption fails.

• Duplicate encrypted files

  If duplicate encrypted files appear, check whether SubmitTranscodeJobs was called multiple times. HLS encryption and transcoding can only be started manually.

"Submit transcode job failed" error with DRM encryption

Symptom: When you submit a transcoding job with DRM encryption, the job fails with the error code TranscodeJob.SubmitFailed.

Cause:

DRM-encrypted transcoding jobs cannot be triggered from ApsaraVideo VOD console > Media Library > Audio/Video > Media Processing > Transcoding Template Group Processing after a video is uploaded.

Solution:

Add a DRM-encrypted transcoding template group to a workflow and use it for transcoding. Workflows.

"Can not found user info" error when uploading a DRM certificate

Symptom: When you upload a DRM certificate, the action fails with the error code NotUserInfoExist.

Solution:

Verify that an enabled VOD bucket exists in the region of your DRM certificate. Enable VOD buckets.

How do I check whether a video is encrypted and which encryption method is used?

You can check this from the console or by calling an API.

Method 1 (console): Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Media Library > Audio/Video. Find the video and click Manage. On the video details page, click the Video URL tab and check the Format column. If the format is mp4, the video is usually not encrypted. If the format is m3u8 and the playback URL contains encryption parameters, the video uses HLS encryption.

Method 2 (API): Call the GetPlayInfo operation and check the response parameters. The Encrypt field indicates whether the video is encrypted (0: not encrypted, 1: encrypted). If Encrypt is 1, check the EncryptType field to determine the encryption method: AliyunVoDEncryption indicates Alibaba Cloud proprietary encryption, and HLSEncryption indicates HLS encryption.

How do I troubleshoot a DRM License error InvalidParameter.ResourceNotFound that occurs only on some devices?

This error usually occurs because the client failed to correctly obtain or configure the DRM certificate (License). Although the License itself is valid, the affected devices have not completed the download and configuration steps. Check and make sure that all clients have correctly downloaded and configured the License file as required by the documentation. You can compare the affected devices with devices that work normally to troubleshoot the issue.

Can DRM encryption and Alibaba Cloud proprietary encryption coexist for the same video resource?

Yes. DRM-encrypted and Alibaba Cloud proprietary encryption streams can coexist under the same videoId. You do not need to upload the video again to generate streams of the other encryption type.

When you play the video, specify the encryption type that matches the stream you want to play:

• To play the Alibaba Cloud proprietary encryption stream on an app, set encryptType: 1.

• To play the DRM-encrypted stream on the web, set isDrm: true.

Why does web playback with an STS token sometimes fail and fall back to the wrong encryption type?

This can happen when a video has both an old and a new transcoding stream. If GetPlayInfo returns only the new stream and the player does not handle the mixed-stream scenario correctly, playback may fall back to the Alibaba Cloud proprietary encryption stream and fail.

To resolve this issue, call DeleteStream to delete the proprietary encryption stream for the video, keep only the DRM-encrypted stream, and try playback again.

Why does HLS playback fail or stop working after I close the developer console when using an older version of the Web Player SDK?

Older versions of the ApsaraVideo Player SDK for web (for example, 2.20.0) are incompatible with newer Edge browser kernels. This incompatibility can cause HLS loading errors, or playback may stop working after you close the browser developer console.

To resolve this issue, upgrade the ApsaraVideo Player SDK for web to the latest version, and make sure that you have applied for a free License to authorize playback.