Configuring DRM in the Management System
When the Mosaic DRM Service is enabled for an environment, all DRM settings for that environment are managed in the Management System, under Admin Settings / DRM Service.
The DRM Service station shows the License Service and Key Service endpoints assigned to the environment, the DRM Tenant ID, and a summary of what is currently configured. From there you reach the four settings areas described below.
Changing DRM settings requires the SETTINGS_EDIT or ADMIN permission for the DRM Service.
Key Seeds​
A key seed is the secret from which the Key Service derives content keys. Given a key seed and a Key ID, the License Service can reconstruct the content key for a video, so encryption keys never have to be stored per asset. See Key Seed Model for the details.
The Key Seed station lists the key seeds of the environment with their name, ID, and creation date, and marks the default one. The default key seed is the one used unless you request a different one.
You can:
- generate a new key seed, giving it a name that describes its purpose
- rename an existing key seed
- delete a key seed you no longer need
Content keys are derived from the key seed that was used at encryption time. If you delete a key seed, videos protected with keys derived from it can no longer be played.
Most setups need only the default key seed. Additional key seeds are useful when you want to separate content sets, for example a catalog whose keys should be retired independently.
Communication Keys​
A communication key signs the License Service Message that your backend sends to the License Service. The signature is what proves that a playback request was authorized by you, so this key must stay on your server side and must never be shipped to a client application.
The Communication Key station lists the keys of the environment with their name, Key ID, and key value. The Key ID and the key value are masked by default; reveal them when you need to configure your backend.
You can generate additional keys, rename them, and delete the ones you no longer use. Use the Key ID to tell the License Service which key you signed a message with, as described under Sign a License Service Message.
Deleting a communication key immediately invalidates every License Service Message signed with it, which stops playback for clients relying on it. Roll over to a new key in your backend before deleting the old one.
FairPlay Credentials​
Apple FairPlay Streaming requires a certificate issued by Apple to your organization. The License Service uses it to encrypt, sign, and deliver licenses to Apple devices. See FairPlay and Axinom DRM for background, and FairPlay Certificate for how to obtain one from Apple.
When the service is enabled, the environment can use the Axinom FairPlay Streaming Test certificate. This lets you test FairPlay playback immediately, but it is limited to evaluation and testing.
Register your own FairPlay Streaming certificate before the environment goes to production. The Axinom test certificate is not permitted for production use and its availability expires.
To register your own credentials, add a FairPlay credential and provide:
| Field | Description |
|---|---|
| Name | A name that identifies the credential in the list |
| Application Certificate | The certificate file issued to you by Apple |
| Application Secret Key (ASK) | The Application Secret Key you received together with the certificate |
| Application Certificate Private Key | The private key file belonging to the certificate |
| Private Key Password | The password protecting the private key file |
Once registered, the station shows the certificate hash and the URL from which the certificate is served. Players that need the FairPlay application certificate can fetch it from this URL, so you do not have to host it yourself.
Widevine Common Encryption API​
The Widevine Common Encryption API lets a packager request keys and protection information over Google's Common Encryption protocol. Configure it here if you use an encoder or packager that integrates with Widevine this way.
The station has two parts.
PlayReady LA URL is the PlayReady license acquisition URL that the Key Service embeds into the protection information it returns. Leave it unset to use the License Service URL of your environment, or set it if licenses are acquired through a proxy or a custom domain.
Credentials are the values Google issues for the Common Encryption API:
| Field | Description |
|---|---|
| Provider Name | The Widevine provider name assigned to you |
| Signing Key | The key used to sign requests to the Common Encryption API |
| Signing IV | The initialization vector used together with the signing key |