> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://fastpix.com/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://fastpix.com/docs/_mcp/server.

# Set up FairPlay DRM

> Learn how to obtain an Apple FairPlay Streaming (FPS) certificate and prepare your deployment package for FastPix DRM integration.

Apple FairPlay Streaming (FPS) protects HLS content across iOS, macOS, and tvOS by encrypting video segments and tying decryption to authorized devices. To enable FPS-protected playback through FastPix, you need four credentials from Apple: a FairPlay certificate, an RSA private key, the key's password, and an Application Secret Key (ASK). This guide provides instructions for obtaining an Apple Developer account, requesting the FPS Deployment Package, generating your private key and CSR with OpenSSL, and downloading the final certificate from the Apple Developer portal.

\


## Contents

* [Before you begin](#before-you-begin)
* **Phase 1: Apple Developer Account & FPS Deployment Package**
  * [Step 1: Create an Apple Developer account](#step-1-create-an-apple-developer-account)
  * [Step 2: Request the FPS Deployment Package](#step-2-request-the-fps-deployment-package)
* **Phase 2: Generate the FairPlay certificate**
  * [Step 3: Generate a private key and CSR](#step-3-generate-a-private-key-and-csr)
  * [Step 4: Generate the FairPlay certificate in the Apple Developer portal](#step-4-generate-the-fairplay-certificate-in-the-apple-developer-portal)
* [What you'll have at the end](#what-youll-have-at-the-end)

\


## Before you begin

Make sure you have the following before starting:

| Requirement        | Details                                                                                                         |
| ------------------ | --------------------------------------------------------------------------------------------------------------- |
| **OpenSSL**        | Installed and accessible from your terminal. Used in Phase 2 to generate the private key and CSR.               |
| **D-U-N-S number** | Required for Apple Developer Program enrollment as an organization. Allow up to 14 business days to obtain one. |
| **Apple ID**       | A personal Apple ID to create your developer account and access the Apple Developer portal.                     |
| **\$99 USD/year**  | Annual fee for the Apple Developer Program membership, required to access FPS credentials.                      |

> **WARNING:**
>
> Apple does not allow you to delete or re-create FairPlay credentials for the same account. Follow each step precisely before proceeding.

\


## Phase 1: Apple Developer account and FPS Deployment Package

### Step 1: Create an Apple Developer account

You need an Apple Developer account to access the FPS Deployment Package.

1. Sign in with your Apple ID at [developer.apple.com/programs/enroll](https://developer.apple.com/programs/enroll/).
2. Select **Organization** as your entity type.
3. Enter your D-U-N-S number when prompted. If you don't have one, request it through [Dun & Bradstreet](https://www.dnb.com/duns-number/get-a-duns.html) before continuing.
4. Complete enrollment and pay the \$99 USD annual membership fee.

> **NOTE:**
>
> Apple reviews organization enrollments manually. Allow 2–5 business days for approval before proceeding to Step 2.

\


### Step 2: Request the FPS Deployment Package

The FPS Deployment Package contains the *FPS Credential Creation Guide*, which you need in Phase 2 to generate your certificate correctly.

1. Go to the [Apple FairPlay Streaming](https://developer.apple.com/streaming/fps/) page.
2. Click **Request Deployment Package**.
3. When asked whether you have completed implementation and testing of the Key Server Module (KSM), select or enter:

   > *"I am using a third-party DRM company and the company has already built and tested KSM."*
4. Submit the form. Apple sends the package to your registered email address.

\


## Phase 2: Generate the FairPlay certificate

### Step 3: Generate a private key and CSR

Use OpenSSL to generate a private key and a Certificate Signing Request (CSR). You need both to create the FairPlay certificate in the Apple Developer portal.

\


#### Generate the private key

Run the following command to generate an AES-256 encrypted RSA private key:

```bash
openssl genrsa -aes256 -out fps_privatekey.pem 1024
```

When prompted, enter a password for the private key. Keep the password under 32 characters. Store this password securely — you need it in later steps.

> **NOTE:**
>
> OpenSSL prompts you to enter the password twice for confirmation. Both entries must match exactly.

\


#### Generate the CSR

Create a **Certificate Signing Request** using the private key you just generated. Replace the placeholder values with your organization's details:

```bash
openssl req -new -sha1 \
  -key fps_privatekey.pem \
  -out certreq.csr \
  -subj "/CN=SubjectName/OU=OrganizationalUnit/O=Organization/C=US"
```

The following table describes each field in the `-subj` argument:

| Field | Description                              | Example              |
| ----- | ---------------------------------------- | -------------------- |
| `CN`  | Common name or subject name              | `MyStreamingService` |
| `OU`  | Organizational unit (team or department) | `Engineering`        |
| `O`   | Organization name                        | `Acme Inc`           |
| `C`   | Two-letter ISO country code              | `US` / `IN`          |

\


### Step 4: Generate the FairPlay certificate in the Apple Developer portal

Upload your CSR to the Apple Developer portal to generate the FairPlay certificate and retrieve the Application Secret Key (ASK).

1. **Open the Certificates section.** Sign in to the [Apple Developer portal](https://developer.apple.com/account/). Navigate to **Certificates, Identifiers & Profiles**, then select **Certificates**.
2. **Select the certificate type.** Click **+** to add a new certificate. Under *Services*, select **FairPlay Streaming Certificate**, then click **Continue**.
3. **Upload the CSR.** Click **Choose File** and upload the `certreq.csr` file you generated in Step 3. Click **Continue**.
4. **Save the ASK (Application Secret Key).** The portal displays the **Application Secret Key (ASK)** string. Copy this value and store it in a secure location immediately. You cannot retrieve the ASK after you leave this page.

   > **WARNING:**
   >
   > If you lose the ASK, you cannot regenerate it. Apple prohibits deletion or re-creation of FairPlay credentials for the same account. Keep a backup in at least two secure locations.
5. **Download the certificate.** After confirming you've saved the ASK, click **Generate**. When the certificate is ready, click **Download** to save the `fairplay.cer` file.

\


## What you'll have at the end

After completing both phases, you should have the following four artifacts. Keep these details secure, as they are required to configure DRM in FastPix.

| Artifact             | Description                                                             |
| -------------------- | ----------------------------------------------------------------------- |
| `fairplay.cer`       | The FairPlay Streaming certificate issued by Apple                      |
| `fps_privatekey.pem` | The AES-256 encrypted RSA private key                                   |
| Private key password | The password you set during key generation (under 32 characters)        |
| ASK                  | The Application Secret Key displayed once in the Apple Developer portal |

> **Next step:**
>
> Provide these four artifacts to **FastPix** to complete your FairPlay Streaming integration.