Apply DRM (Digital Rights Management) encryption to videos in ApsaraVideo VOD and play them back using ApsaraVideo Player SDK.
Limitations
You can enable DRM encryption only in the ApsaraVideo VOD console.
Billing
DRM encryption uses the pay-as-you-go billing method with no minimum fees. Charges consist of two parts:
| Charge type | When charged |
|---|---|
| Transcoding fee | When a video is transcoded with DRM encryption enabled. |
| License fee | Each time a device requests a license to play a DRM-encrypted video. |
For pricing details, see DRM encryption.
DRM encryption compatibility
DRM solution | Mobile devices | Browsers |
Widevine | Android | Chrome, Firefox 47 and later, Microsoft Edge, and Opera |
FairPlay | iOS | Safari |
Apply DRM encryption
Step 1: (Optional) Apply and upload DRM certificate
To protect content for iOS devices with FairPlay, you must apply for and upload a FairPlay certificate. You can skip this step if you only need to protect content for Android devices by using Widevine.
Apply for a FairPlay certificate.
For more information, see Apply for a FairPlay Streaming certificate.
Upload the FairPlay certificate.
Log on to the ApsaraVideo VOD console.
In the left-side navigation pane, choose Configuration Management > Media Processing > DRM Certificates.
Click Upload Certificate.
Parameter
Description
Certificate Name
A name for the certificate, 2 to 32 characters in length.
Content
The FairPlay certificate file. Only files with the .cer extension are supported.
Private Key
The password-protected private key that you created when applying for the certificate.
Passphrase
The key used to decrypt the private key. It must be 1 to 32 characters long and can contain letters and digits.
ASk
The Application Secret Key (ASk) from Apple. It must be 1 to 32 characters long and can contain letters and digits.
Click OK.
Step 2: Create a DRM transcoding template group
Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Configuration Management > Media Processing > Transcoding Template Groups.
On the Transcoding Template Groups page, click Create Transcoding Template Group to create a DRM-enabled transcoding template group.
You can enable DRM encryption in both regular transcoding templates and video packaging templates. The following steps show how to enable DRM encryption in a regular transcoding template:
In the Basic information section, set Encapsulation Format to HLS.
In the Advanced Parameters section, enable Video Encryption and select DRM Encryption.
Configure other parameters as needed. For detailed parameter descriptions, see Transcoding templates.
Click Save.
Save this ID. You need it to start a DRM encryption job.
Step 3: (Optional) Create a workflow for DRM transcoding
A workflow orchestrates media processing tasks such as transcoding, content review, and snapshotting in a specific order. When triggered during media upload or processing, the workflow automatically processes the media file according to the predefined steps.
You can add a transcoding node that uses your DRM-enabled transcoding template group to a workflow. You can create workflows only in the ApsaraVideo VOD console. For more information, see Workflows.
Step 4: Start a DRM transcoding job
Transcoding can be triggered both during and after a video upload. You can start a job by using a transcoding template group directly or by using a workflow that includes a transcoding node.
Currently, DRM-encrypted transcoding can only be triggered by using a transcoding template group and a workflow during video upload, or by using a workflow after video upload. Using a transcoding template group to trigger DRM-encrypted transcoding after a video is uploaded is not supported. For detailed instructions, see Audio and video transcoding for the console method and Audio and video transcoding for the OpenAPI method.
Step 5: Check the job result
Receive event notifications
If event notifications are configured for ApsaraVideo VOD, task information is sent in the SingleStreamTranscodeComplete or TranscodeComplete callback messages. For more information about how to configure event notifications, see Event Notification.
Query the job status
Play a DRM-encrypted video
DRM-encrypted videos can be played only by using ApsaraVideo Player SDK.
ApsaraVideo Player SDK supports multiple platforms, including iOS, Android, and web (HTML5 and Flash). Integrate the SDK into your applications or websites to enable playback of DRM-encrypted videos.
When using ApsaraVideo Player SDK to play DRM-encrypted videos, note the following:
ApsaraVideo Player SDK 5.2.1 or later is required. FairPlay is supported on iOS, and Widevine is supported on Android.
A player license is required before you use ApsaraVideo Player SDK. For more information, see Obtain a license.
Before integrating ApsaraVideo Player SDK, review the DRM compatibility for each platform. For more information, see Compatibility of ApsaraVideo Player SDK.
For instructions on playing DRM-encrypted videos, see the playback guide for your target platform: Play an encrypted video, Play an encrypted video, and Play an encrypted video.
Operations such as rotate, mirror, and screenshot are not supported during playback of DRM-encrypted videos.
FAQ
What do I do if the "Can not found user info" error occurs when I upload a DRM certificate?
What do I do if the "Submit transcode job failed" error occurs when I start a DRM encryption job?
What do I do if a DRM-encrypted video fails to play in a browser?
What do I do if FairPlay playback returns a 503 error?
If a DRM-encrypted video returns a 503 error during FairPlay playback in Safari, but plays back normally using Widevine in Chrome, troubleshoot as follows:
Check the FairPlay certificate status. Log on to the ApsaraVideo VOD console, and choose Configuration Management > Media Processing > DRM Certificate Management to check whether a FairPlay certificate has been uploaded and its status is normal. If the certificate list is empty or the certificate has expired, apply for and upload a new FairPlay certificate.
Verify the certificate parameters. Make sure that the ASK and Passphrase values that you entered when you uploaded the certificate match the information on your Apple Developer certificate. The ASK is provided by Apple, and the Passphrase is the key used to decrypt the private key. Both values must exactly match the information that you used when you applied for the certificate.
Diagnose the license request. In Safari, open Developer Tools (F12), switch to the Network tab, play the DRM-encrypted video, and filter for the license request. Check the response status code and response body. A 503 error usually indicates that the DRM license service is temporarily unavailable, or that the certificate configuration is causing the server to reject the request.
Troubleshoot by comparing browsers. If the same video plays back normally in Chrome using Widevine, the DRM encryption and transcoding are not the issue. Focus your troubleshooting on the FairPlay certificate configuration or the Apple license service.