Hello, We are seeing an issue where AVPlayer sometimes reports time values close to 95,443 seconds (~26.5 hours), even though the actual content duration is much shorter. For example, in normal cases we see: currentTime: ~355 seconds duration: 6958 seconds seekableTimeRange: 0...6958 seconds However, in some cases AVPlayer reports values around: currentTime: ~95443 seconds duration: ~95449 seconds We checked the underlying MPEG-TS segments with ffprobe. The video and audio PTS values are around 6426 seconds and are consistent with the HLS EXTINF durations, so we do not see a 95,443-second timestamp directly in the media segments. Could you please help us understand: 1- Why can AVPlayer expose values close to 95,443 seconds? 2- Could this be related to MPEG-TS PTS wrap-around or AVFoundation timeline mapping? 3- How does AVPlayer calculate currentTime and AVPlayerItem.duration for HLS MPEG-TS content? Interestingly, Audio Only / Now Playing mode shows the expected timeline, while video playback can expose the incorrect values. Thank you.

Is there a supported public API on iOS/iPadOS 27 to apply SensitiveContentAnalysis to FairPlay Streaming-protected, on-demand HLS playback in AVPlayer, so that sensitive video is withheld before presentation, including after seeking or resuming, while preserving FairPlay protection? The intended behavior is on-device analysis of the actual protected presentation, with playback held until the required safety decision is available. This includes preventing the first sensitive frame from appearing and applying the corresponding audio intervention. The app must not obtain raw content keys or create a decrypted copy or clear proxy for analysis. I reviewed the public APIs and the iPhoneOS 27.0 SDK headers in Xcode 27.0 (27A266a): SCSensitivityAnalyzer's video-analysis entry point accepts a file URL; I have not found an entry point that attaches to an AVContentKeySession or a protected AVPlayerItem. SCVideoStreamAnalyzer is documented in terms of conference-call participants and incoming/outgoing streams. It accepts a capture-device input, a VTDecompressionSession, or individual pixel buffers. Its decompression-session path is documented to produce blank frames when sensitive content is detected, but I have not found a supported way to attach it to AVPlayer's FairPlay-protected decoding path. SCVideoStreamAnalyzer's initializer throws if both Communication Safety and Sensitive Content Warnings are off. Analysis would only be required when the relevant device policy is enabled. AVPlayer.h, lines 853–856, documents that allowsCaptureOfClearKeyVideo defaults to NO and has no effect on FairPlay Streaming content. I therefore cannot treat that property as a route to analyze protected frames through AVPlayerItemVideoOutput. Is SCVideoStreamAnalyzer supported for this protected on-demand use case? If so, which API connects it to the protected playback path, and what guarantees cover withholding sensitive frames and coordinating audio at initial playback, seek, and resume? If the requirement is unsupported with public APIs, confirmation of that limitation would help determine the product architecture. This is an API feasibility question based on documentation and header inspection. I do not yet have a focused reproduction project or a physical-device result, and I am not reporting a reproduced framework failure. References: https://developer.apple.com/documentation/sensitivecontentanalysis/scvideostreamanalyzer https://developer.apple.com/documentation/sensitivecontentanalysis/scsensitivityanalyzer/videoanalysishandler https://developer.apple.com/documentation/avfoundation/avplayer/allowscaptureofclearkeyvideo

We maintain an existing iOS/tvOS App Store application that uses AVFoundation for authenticated streaming playback. One upstream provider supplies some account-entitled playback sessions as fragmented MP4 using ISO Common Encryption scheme cenc (AES-CTR). The provider controls the rendition, and no corresponding cbcs rendition is available to our client. We understand that Apple’s documented FairPlay Streaming path supports cbcs. We identified com.apple.coremedia.allow-mpeg4streaming as relevant to this playback case, but the entitlement is undocumented and does not appear under Capability Requests for our App ID. Apple Developer Support was unable to identify the request process and recommended posting this question in the forums and filing Feedback Assistant report FB24649355. Could an Apple engineer clarify: Is this entitlement available to third-party iOS/tvOS applications? If so, what is the official request process? We can provide additional technical information privately if an Apple engineer needs it.

We are seeking assistance regarding an ongoing issue with FairPlay Streaming (FPS) certificates in our Apple Developer account. We are currently unable to generate a new FairPlay Streaming certificate because the Apple Developer portal displays: “Maximum number of certificates generated” The FairPlay Streaming Certificate option is disabled, and there is no option available to generate a new certificate. We have also checked our existing FairPlay Streaming certificates. When opening an existing certificate, the certificate details page only provides a Download option. There is no option to Revoke, Delete, or Remove the existing FairPlay Streaming certificate. We have attached screenshots showing: The FairPlay Streaming Certificate section displaying “Maximum number of certificates generated.” An existing FairPlay Streaming Certificate showing only the Download option, with no option to revoke or delete it. The FairPlay Streaming Test Certificate option showing that we are not allowed to perform the operation and should contact Apple Developer Program Support. Account information: Entity Name: DIGIZION PRIVATE LIMITED Team ID: HK7FAN55HP Certificate Type: FairPlay Streaming Certificate Name: DIGIZION PRIVATE LIMITED Certificate Expiration: Never The reason we need a new FairPlay Streaming certificate is that our server infrastructure experienced a crash. As a result, we permanently lost the private keys and certificate-related credentials associated with our previous FairPlay Streaming setup. Unfortunately, we did not have a backup of these private keys. Because the private keys were lost, we are unable to use the existing certificate credentials with our new server infrastructure. We therefore need to generate a new FairPlay Streaming certificate and configure our production DRM infrastructure again. However, we are currently blocked because the certificate generation limit has been reached, while the Apple Developer portal does not provide us with any option to revoke, delete, or remove an existing FairPlay Streaming certificate. We have already submitted approximately 10 support requests/messages to Apple regarding this same issue, but we have not received a response providing a solution or instructions for resolving the certificate limit issue. Could someone from Apple Developer Support or the FairPlay Streaming team please review this issue and advise us on how we can resolve it? We would greatly appreciate assistance with one of the following: Revoke/remove an existing FairPlay Streaming certificate so that we can generate a new certificate; or Reset or increase the FairPlay Streaming certificate generation limit for our Team ID; or Provide the correct procedure or an Apple-side solution that will allow us to generate a new FairPlay Streaming certificate. We understand that FairPlay Streaming certificates may have certificate-generation limitations. However, in our situation, the previous server crash resulted in the permanent loss of our private keys, and we have no backup from which we can recover them. This issue is currently blocking our production DRM/FairPlay Streaming integration and preventing us from completing our production infrastructure setup. We would therefore greatly appreciate it if Apple Developer Support could review Team ID HK7FAN55HP and help us either revoke an existing certificate or reset/increase the certificate generation limit so that we can generate a new FairPlay Streaming certificate. Thank you for your time and assistance.

Keywords: FairPlay, FairPlay Streaming, FPS Certificate, DRM, Certificate Limit, License Server Hello Apple Developer Forums Team, We are seeking guidance regarding a FairPlay Streaming (FPS) certificate issue that is currently blocking our production DRM infrastructure. We previously generated FairPlay Streaming deployment credentials and have been using FairPlay Streaming for our protected video content. Unfortunately, our old server infrastructure crashed, and the private keys/credentials associated with the previously generated FairPlay Streaming certificate were permanently lost. As a result, we need to generate replacement FairPlay Streaming deployment credentials. However, when attempting to create a new FairPlay Streaming certificate, our Apple Developer account now displays the following error: “Maximum number of certificates generated.” The main issue is that the existing FairPlay Streaming certificates do not provide any option in the Apple Developer portal to revoke or delete them. Therefore, we are unable to remove obsolete or inaccessible certificate records and cannot generate replacement credentials. Our current situation is: We have reached the maximum number of FairPlay Streaming certificates allowed for our Developer Team. The Apple Developer portal does not provide a revoke or delete option for the existing FPS certificates. The private keys associated with our old FairPlay Streaming credentials were permanently lost after our previous server infrastructure crashed. We cannot recover or reuse those old credentials. We are unable to generate replacement FairPlay Streaming deployment credentials because the certificate generation limit has been reached. This is currently blocking our ability to restore and maintain our FairPlay-protected production streaming service. We have already contacted Apple Developer Support and submitted multiple follow-ups regarding this issue, but we have not yet received a solution that allows us to generate replacement credentials. We would like to understand the official Apple-supported process for the following situation: What is the supported procedure when a Developer Team reaches the maximum number of FairPlay Streaming certificates? If existing FPS certificates cannot be revoked or deleted through the Developer portal, is there an Apple-supported process to remove obsolete or inaccessible FPS certificate records? Can Apple reset or restore the FairPlay Streaming certificate generation capacity for a Developer Team when the old credentials and private keys are permanently unavailable? Is there another supported method for generating replacement FairPlay Streaming deployment credentials in this situation? We are not requesting general instructions on how to generate a FairPlay Streaming certificate. We understand the standard certificate generation process. Our issue is specifically related to an exhausted FPS certificate generation limit combined with the absence of a self-service revoke/delete option for the existing certificates. We would greatly appreciate guidance from Apple or the FairPlay Streaming team on how to resolve this issue and restore our ability to generate replacement FPS deployment credentials. Thank you for your assistance.

Currently we are building a service based on Fairplay SDK version 26.0. Currently our solution is using version 4.5.4. When we run the below request to get version we get proper response curl http://xx.xx.xx.xx:8080/fps/v Response - V26.0 Our client applications call below two APIs https://GW_HOST:8080/fairplay_cert https://GW_HOST:8080/fairplay_license Within the cert API call, we are returning the fairplay public certificate. Currently we are trying to use the test certificate provided along with Fairplay SDK (test_fps_certificate_v26.bin) Then within the fairplay_license API call, we are trying to reach fairplay service based on Fairplay SDK v26 We are seeing some issues with below request(attaching the request json payload) curl -v -X POST -H "Content-Type: application/json" -d @SDKValidation_NewCert.json http://xx.xx.xx.xx:8080/fps SDKValidation_NewCert.json We are getting below response from SDK {"fairplay-streaming-response":{"create-ckc":[{"id":1,"status":-42605}]}} When we checked the apache error logs in the file "/etc/httpd/logs/error_log" we see below error [DEBUG] ❌ Assertion failure: invalidCertificateErr (-42605) [src/extension.swift:249] This is looks to be some error related to certificate. As mentioned earlier, client application is making a certificate call where we are returning the certificate set up . These certificates are already configured in the credentials path. Also note that the test samples provided with the SDK return valid license response. We had earlier raised a similar ticket mentioned below and we were asked not to use test certs. So we have raise CSR and used new certs for testing. https://developer.apple.com/forums/thread/836652?page=1

Our app was transferred to a different Apple Developer Program team. Our FairPlay Streaming deployment package (Application Certificate and ASk) was issued under the original team, whose membership has since expired. FairPlay playback continues to work normally. We understand from these threads that FPS does not enforce the Application Certificate's own expiration date: https://developer.apple.com/forums/thread/74831 https://developer.apple.com/forums/thread/763861 Our question is a different one — about the team's membership status rather than the certificate's validity period: Does the validity of an FPS deployment package depend in any way on the membership status of the team it was issued under, or are the credentials independent of that once issued? This is not a bug report. We would like to confirm the expected behaviour rather than rely on our own assumptions.

Hi, I submitted a FairPlay Streaming credentials approval request 5 days ago (through the "Request FairPlay Streaming credentials approval" form) and haven't received any response yet. Could someone from the Security Engineering team please check the status? Team ID: US7RGQX775 We're an online education platform and use a third-party DRM/video hosting provider (VdoCipher) that already operates a working, tested FairPlay Streaming KSM on our behalf — we just need the certificate to hand over to them. Thanks in advance!

I implemented an AVContentKeySessionDelegate that after calling processContentKeyRequest succeeds in producing a contentKey in the callback func contentKeySession(_: AVContentKeySession, didProvide _contentKey: AVContentKey) of the AVContentKeyRecipient that manages the decoding of CMSampleBuffers. However, when I store the AVContentKey from the contentKeySession callback and try to attach it to the CMSampleBuffer with AVSampleBufferAttachContentKey, I get the error: Error Domain=AVFoundationErrorDomain Code=-11836 "Cannot Open" UserInfo={NSLocalizedFailureReason=This app is not authorized to play this file., NSLocalizedDescription=Cannot Open, NSUnderlyingError=0x28303a220 {Error Domain=NSOSStatusErrorDomain Code=-12161 "(null)"}} Does anyone have some insight on why this is happening and how to solve it?

Due to hysterical raisins, our Apple Developer Account (2A...FW) has five FairPlay Streaming resources under https://developer.apple.com/account/resources/certificates/list Three of these are certificates (fairplay.cer) and two of them are provisioning packages (fps-bundle.zip). The three certificates all use 1024-bit RSA keys and have creation dates of: Oct 24 23:22:09 2016 (expired Oct 25 23:22:09 2018) 3J Mar 29 19:39:15 2018 (expired Mar 29 19:39:15 2020) 2N Feb 11 00:32:06 2026 (expires Feb 1 00:22:57 2027) LD (I've included the first two characters of the Apple resource ID to help keep these straight.) The key for the first two (same key for both) is lost to the mists of time. The third is a cert I created from a new key, so I have the key for it. (The developer portal will not let us create any more 1024-bit FairPlay certs.) The two FPS bundles each contain an fps_certificate.bin which itself contains a 1024-bit cert and a 2048-bit cert. Looking at this file in each bundle, the bundles include the same 1024-bit cert that I created on Feb 11, but two different 2048-bit certs with creation dates of: Feb 11 00:32:06 2026 (expires Feb 11 00:32:05 2028) YP Feb 11 00:56:22 2026 (expires Feb 11 00:56:21 2028) 9N Both 2048-bit certs use the same key (which I have). Finally, we use a third-party as our streaming provider. With them we shared the first FPS bundle (YP). So, this is a big mess. And I'm unable to delete any of these entries from our developer account. Questions: Does the expiration date on these certs matter or is it ignored for streaming purposes? How do we delete FP certs/bundles we no longer need/use/are expired? With respect to using third-party vendors for streaming (with whom we've shared an FPS bundle): Is it okay to re-use the same FPS bundle if we change vendors? Should we ask Apple to delete an FPS bundle once we stop using a vendor?

Currently we are building a service based on Fairplay SDK version 26.0. Currently our solution is using version 4.5.4. When we run the below request to get version we get proper response curl http://xx.xx.xx.xx:8080/fps/v Response - V26.0 Our client applications call below two APIs https://GW_HOST:8080/fairplay_cert https://GW_HOST:8080/fairplay_license Within the cert API call, we are returning the fairplay public certificate. Currently we are trying to use the test certificate provided along with Fairplay SDK (test_fps_certificate_v26.bin) Then within the fairplay_license API call, we are trying to reach fairplay service based on Fairplay SDK v26 We are seeing some issues with below request(attaching the request json payload) curl -v -X POST \ -H "Content-Type: application/json" \ -d @SDKValidation.json \ http://xx.xx.xx.xx:8080/fps SDKValidation.json We are getting below response from SDK {"fairplay-streaming-response":{"create-ckc":[{"id":1,"status":-42605}]}} When we checked the apache error logs in the file "/etc/httpd/logs/error_log" we see below error [DEBUG] ❌ Assertion failure: invalidCertificateErr (-42605) [src/extension.swift:249] This is looks to be some error related to certificate. As mentioned earlier, client application is making a certificate call where we are returning the test certificates provided along with the SDK (test_fps_certificate_v26.bin). These certificates are already configured in the credentials path. Also note that the test samples provided with the SDK return valid license response.

Hello, I have a problem generating a 2048-bit FairPlay Streaming certificate. I tried generating SDK v26.x certificate in two ways. (1) Use existing certificate (2) Create new certificate Though, in both ways, Apple gives me a certificate bundle of 1024-bit certificate. (fps_certificate.bin) I've uploaded 2048-bit CSR on creating a certificate. Just to note, I have created a SDK v4.x certificate few years ago. Have anyone bumped into a same issue? Or am I missing something?

Currently we are building a service based on Fairplay SDK version 26.0. Currently our solution is using version 4.5.4. When we run the below request to get version we get proper response curl http://xx.xx.xx.xx:8080/fps/v Response - V26.0 Our client applications call below two APIs https://GW_HOST:8080/fairplay_cert https://GW_HOST:8080/fairplay_license Within the cert API call, we are returning the fairplay public certificate. Currently we are trying to use the test certificate provided along with Fairplay SDK (test_fps_certificate_v26.bin) Then within the fairplay_license API call, we are trying to reach fairplay service based on Fairplay SDK v26 We are seeing some issues with below request(attaching the request json payload) curl -v -X POST \ -H "Content-Type: application/json" \ -d @SDKValidation.json \ http://xx.xx.xx.xx:8080/fps SDKValidation.json We are getting "Empty response from server" When we checked the apache error logs in the file "/etc/httpd/logs/error_log" we see some exception. We are sharing the traces in a file (ApacheErrorLogs.txt). ApacheErrorLogs.txt Also if we use old pblic key used with version 4.5.4, we are getting another error from service. {"fairplay-streaming-response":{"create-ckc":[{"id":1,"status":-42605}]}} Can you please help us with the reason of this failure?

Hi everyone, I am working on an app that supports offline playback with FairPlay Streaming (FPS). I have successfully implemented the logic to download and persist the content keys (TLLV), and offline playback is working correctly using the stored persistent keys. However, I am now trying to implement a manual renewal process for these licenses, and I’ve run into an issue where the delegate methods are not being fired as expected. The Issue: I am calling contentKeySession.addContentKeyRecipient(asset) to force a renewal or re-fetch of the content key for a specific asset. Even though the asset is correctly initialized and the session is active, the AVContentKeySessionDelegate methods (specifically contentKeySession(_:didProvide:)) are not being triggered at all. My Questions: Why is the delegate not firing when adding the recipient? Is there a specific state or property the AVURLAsset needs to have (or a specific way it should be initialized) to trigger a new key request via addContentKeyRecipient? Is it possible to perform a manual license renewal triggered by a UI action (e.g., a button tap) without actually initiating playback of the asset? The goal is to allow users to refresh their licenses manually while online, ensuring the content remains playable offline before the previous license expires, all without forcing the user to start the video. Any insights or best practices for this manual renewal flow would be greatly appreciated.

Hi, I’ve identified a discrepancy between the FairPlay Streaming SPC v3 documentation and the provided Swift reference implementation regarding the SPC payload length field. Documentation states: The SPC V3 structure defines: SPC payload length: 4 bytes However, in Apple’s Swift sample implementation: // Move local offset by 12 to adjust for padding localOffset += 12 spcContainer.spcDataSize = Int(try readBigEndianU32(spc, localOffset)) This indicates: A 16-byte field (12 bytes padding + 4-byte length) This behavior also matches the SPC sample provided in the FairPlay Streaming SDK (sample_spc_v3.b64 ). 00000003 // spc version 00000000 // reserved .... 00000000000000000000000000000f40 // spc payload length (16 bytes) Could you please confirm the correct implementation? Thanks

Hi, I received an SPC without a device Identity TLLV and with an invalid (i.e a value that is not specified in the FairPlay programming guide) value of device type in the Device info TLLV. The info I got is the following - Apple Device Type: Type:0x555ea482e2ef0a7c, OS version:189.121.178 Does anyone know what device type it is, and why it does not conform to the Apple spec? Also, should I accept such an SPC or is it not valid? Thanks.

We are developing a video streaming app that uses AVContentKeySession with FairPlay Streaming. Our implementation supports both online playback (non-persistable keys) and offline playback (persistable keys). We have observed the following behavior: Once a content key has been obtained for a given Content Key ID, AVContentKeySession does not trigger contentKeySession(_:didProvide:) again for that same Key ID We also attempted to explicitly call processContentKeyRequest(withIdentifier:initializationData:options:) on the session to force a new key request for the same identifier, but this did not result in the delegate callback being fired again. The session appears to consider the key already resolved and silently ignores the request. This means that if a user first plays content online (receiving a non-persistable key), and later wants to download the same content for offline use (requiring a persistable key), the delegate callback is not fired again, and we have no opportunity to request a persistable key. Questions Is this the expected behavior? Specifically, is it by design that AVContentKeySession caches the key for a given Key ID and does not re-request it — even when processContentKeyRequest(withIdentifier:) is explicitly called? Should we use distinct Content Key IDs for persistable vs. non-persistable keys? For example, if the same piece of content can be played both online and offline, is the recommended approach to have the server provide different EXT-X-KEY URIs (and thus different key identifiers) for the streaming and download variants? Is there a supported way to force a fresh key request for a Key ID that has already been resolved — for example, to upgrade from a non-persistable to a persistable key? Environment iOS 18+ AVContentKeySession(keySystem: .fairPlayStreaming) Any guidance on the recommended approach for supporting both streaming and offline playback for the same content would be greatly appreciated.

Hi, Has anyone been able to protect the audio part of FairPlay protected content from being captured as part of screen recording on Safari/iOS (PWA and/or online web app)? We have tried many things but could not prevent the audio from being recorded. Same app and content on Safari/Mac does not allow audio to be recorded. Any tips?

Hi, Our client currently has an FPS deployment certificate generated with SDK version 4 that is still actively used in production. They would like to generate an additional certificate using SDK version 26. Before doing so, they just want to confirm: Will the existing SDK 4 certificate remain unaffected and still visible in the Apple Developer portal? Any considerations they should keep in mind? Thanks! :)

Hi, Our client currently has an FPS deployment certificate generated with SDK version 4 that is still actively used in production. They would like to generate an additional certificate using SDK version 26. Before doing so, they just want to confirm: Will the existing SDK 4 certificate remain unaffected and still visible in the Apple Developer portal? Any considerations they should keep in mind? Thanks!