Answers to common questions about HLS encryption, Alibaba Cloud proprietary encryption, and DRM encryption in ApsaraVideo VOD.
HLS encryption
What is MtsHlsUriToken and how do I obtain it?
The MtsHlsUriToken is a user token for HLS encryption. The M3U8 manifest contains a URL pointing to a decryption key server. To restrict access, add an authentication layer to your key server and append the MtsHlsUriToken, generated by your authentication logic, to the decryption key URL for verification.
To configure encryption, set up a token issuance service that generates MtsHlsUriToken (Step 1 in HLS encryption).
How do I use the generated key?
The GenerateKMSDataKey operation returns a ciphertext key (CiphertextBlob) and a plaintext key (Plaintext). Pass only the ciphertext key to ApsaraVideo VOD, as specified in EncryptConfig: specifies the configurations for HLS encryption in SubmitTranscodeJobs.
-
Cache both the generated ciphertext key and plaintext key.
-
A service key cannot be deleted or updated after creation. It is used only to generate encryption keys.
How do I pass a token to the decryption service?
Use an Alibaba Cloud CDN domain name for playback. Pass the MtsHlsUriToken parameter when requesting an M3U8 address. The system automatically rewrites MtsHlsUriToken for the decryption service and sends the request.
How do I verify that an encrypted video plays correctly?
Use Alibaba Cloud Player Diagnostic Platform to test HLS-encrypted M3U8 playback. Enter the M3U8 URL and the MtsHlsUriToken value (if set) to verify decryption and playback.
Other FAQs
-
API error message
If SubmitTranscodeJobs returns KeyNotFound, contact ApsaraVideo VOD technical support to create a service key in the required region, such as China (Beijing) or China (Shanghai). The service key is used to generate encryption keys.
-
Unencrypted file
If the output file is not encrypted, go to your transcoding template and confirm that Video Encryption is enabled and Alibaba Cloud Proprietary Cryptography is selected.
-
Custom key
Custom strings cannot be used as encryption keys. Generate the plaintext key by calling GenerateKMSDataKey.
-
Encryption failure
If HLS encryption and transcoding fail with no output, verify that the key generated by GenerateKMSDataKey is of the AES_128 type.
-
Decryption failure
If an HLS-encrypted video fails to decrypt for playback, verify that the decryption service Base64-decodes the plaintext key returned by DecryptKMSDataKey before sending it to the player. If the plaintext key is not decoded, the decryption fails.
-
Duplicate encrypted files
If duplicate encrypted files appear, check whether SubmitTranscodeJobs was called multiple times. HLS encryption and transcoding can only be started manually.
DRM encryption
"Submit transcode job failed" error with DRM encryption
Symptom: When you submit a transcoding job with DRM encryption, the job fails with the error code TranscodeJob.SubmitFailed.
Cause:
DRM-encrypted transcoding jobs cannot be triggered from ApsaraVideo VOD console > Media Library > Audio/Video > Media Processing > Transcoding Template Group Processing after a video is uploaded.
Solution:
Add a DRM-encrypted transcoding template group to a workflow and use it for transcoding. Workflows.
"Can not found user info" error when uploading a DRM certificate
Symptom: When you upload a DRM certificate, the action fails with the error code NotUserInfoExist.
Solution:
Verify that an enabled VOD bucket exists in the region of your DRM certificate. Enable VOD buckets.