Troubleshooting Common Issues in EasyDCP KDM Generator+EasyDCP KDM Generator+ is a widely used tool for creating KDMs (Key Delivery Messages) that securely deliver decryption keys to cinema playback servers and other secure playback environments. While the software is generally stable and reliable, users sometimes encounter issues that can interrupt workflows or prevent KDMs from being generated or accepted. This article walks through common problems, diagnostic steps, and practical fixes to get you back on track quickly.
1) KDM generation fails or produces errors
Symptoms: KDM creation aborts with an error message, or the generated KDM cannot be opened by the target server.
Possible causes and fixes:
- Incorrect certificate or missing private key — Ensure you’re using the correct recipient certificate (Cinema or CRL) and that the corresponding private key is available and unlocked. In EasyDCP KDM Generator+ you must import certificates and associated private keys into your key store. If the key is missing, re-import the PEM/PFX file and enter the correct passphrase.
- Certificate expired or revoked — Check certificate validity dates and revocation status. Replace expired certificates with updated ones from the recipient or CA.
- Wrong certificate type — Some targets require specific certificate types (e.g., X.509 with specific extensions). Confirm the recipient’s requirements and use the matching certificate.
- Malformed CPL/PKL input — Ensure the Composition Playlist (CPL) or Packing List (PKL) you select is valid and correctly formatted. Regenerate the CPL/PKL from your mastering tool if necessary.
- Clock skew/time mismatch — KDMs include a validity window. If your system clock is wrong, the KDM’s start or end time may be invalid. Sync your system time with a reliable NTP server before generating KDMs.
- Software bug or corrupted installation — Try restarting the application, checking for updates, or reinstalling EasyDCP KDM Generator+. Back up your keys and settings first.
Diagnostic tips:
- Note and copy the exact error message; it often contains the specific failure reason.
- Test with a known-good recipient certificate and CPL to isolate whether the issue is environment-specific.
2) Recipient server rejects the KDM
Symptoms: KDM imports but is rejected by the playback server or DCP player with “invalid KDM,” “signature error,” or “unsupported format.”
Possible causes and fixes:
- Signature mismatch — KDMs are signed; if the signature is invalid the target will reject it. Confirm that your signing certificate/private key pair is correct and not corrupted.
- Incorrect recipient certificate used — The KDM must be encrypted for the recipient’s public key. Double-check you selected the correct recipient certificate when generating the KDM.
- Hash or algorithm compatibility — Some playback systems require specific algorithms (e.g., SHA-256 vs SHA-1). Verify the signing/encryption algorithm settings in EasyDCP and choose compatible options if available.
- Time window outside permitted range — The KDM’s valid-from and valid-until timestamps must fall within acceptable ranges for the recipient. Ensure timezone handling is correct and set appropriate start/end times.
- Malformed XML or whitespace issues — Rarely, differences in XML formatting can cause strict parsers to reject KDMs. Try exporting KDM with default formatting or use another export option if available.
Diagnostic tips:
- Import the KDM into a secondary validation tool or another server to see whether rejection is specific to one target.
- Compare the recipient certificate fingerprint expected by the server to the one used to create the KDM.
3) Problems with certificate import/export
Symptoms: Certificates fail to import into EasyDCP KDM Generator+ or exported KDMs lack expected recipient entries.
Possible causes and fixes:
- Unsupported file format — EasyDCP expects PEM/DER/PFX formats for certificates and keys. Convert certificates to a supported format using OpenSSL if necessary:
openssl pkcs12 -in cert.pfx -out cert.pem -nodes
- Password-protected key issues — When importing PFX/PKCS#12 files, ensure you use the correct password. If the password is lost, ask the certificate owner to reissue.
- Certificate chain not included — Some recipients send only leaf certificates; you may need to import intermediate/CA certificates to build a full chain. Import all chain components into your local store.
- File encoding or line-ending problems — Ensure PEM files are ASCII with correct BEGIN/END markers and no extraneous characters.
Diagnostic tips:
- Validate certificate files using OpenSSL commands such as:
openssl x509 -in recipient.crt -text -noout
- Check fingerprints:
openssl x509 -in recipient.crt -noout -fingerprint
4) Time window and timezone issues
Symptoms: KDM appears valid in your generator but is rejected by recipients saying it’s not yet valid or expired.
Possible causes and fixes:
- Local clock incorrect — Sync your machine with NTP and ensure timezone settings are correct.
- Daylight saving/timezone differences — Be explicit when selecting KDM validity times. Use UTC where possible to avoid ambiguity.
- Intermediate systems changing timestamps — Some file transfer systems or metadata handlers may alter timestamps. Verify the KDM content timestamps after transfer (open the KDM XML and check
/ values).
Diagnostic tips:
- Open the KDM XML and inspect the NotBefore/NotAfter elements to confirm exact UTC timestamps.
- Ask the recipient for server time or timezone to correlate with your validity window.
5) Multiple recipients or large recipient lists causing failures
Symptoms: KDM creation fails or becomes slow when adding many recipients.
Possible causes and fixes:
- Resource limits — Generating a KDM for many recipients increases processing and memory use. Break large recipient lists into smaller batches.
- Recipient certificate duplicates — Ensure each recipient certificate is unique. Duplicate entries can confuse the generator.
- Export/transport size limits — Large KDM files or many individual KDMs may exceed email or transfer limits. Consider compressing KDMs, using secure file transfer, or distributing separate KDMs per group.
Diagnostic tips:
- Test generation with a subset of recipients to identify thresholds.
- Monitor CPU/memory during generation to see whether system resources are exhausted.
6) Incorrect or missing CPL/PKL selection
Symptoms: Generated KDM does not unlock the intended compositions or shows mismatched asset IDs.
Possible causes and fixes:
- Selecting wrong CPL/PKL — Verify the CPL you selected corresponds to the DCP version you intend to unlock. Use checksums or asset IDs in both CPL and PKL to confirm.
- Multiple versions of CPL — If several CPLs exist for the same title, choose the correct one by checking creation timestamps and reel lists.
- Mismatched UUIDs — If CPL/PKL were modified after signing, asset UUIDs might no longer match the content on the playback server. Re-export an unmodified CPL/PKL from the mastering tool.
Diagnostic tips:
- Open the CPL/PKL XML and confirm asset IDs match the encrypted track files on the server.
- Use EasyDCP or third-party validators to inspect the CPL structure.
7) User-permission and access errors
Symptoms: “Access denied,” inability to write to output folder, or failure to access protected key store.
Possible causes and fixes:
- File system permissions — Ensure the EasyDCP application has write permission to the chosen output directory. Run as administrator or adjust folder permissions if needed.
- Protected key store access — If keys are kept in an OS-protected store, ensure the running user has access or run the application under the appropriate account.
- Antivirus or security software interference — Security software may block certificate/key access or file creation. Temporarily whitelist EasyDCP processes or adjust policies.
Diagnostic tips:
- Try saving to a different directory (desktop or user documents) to check permissions.
- Check OS event logs and antivirus logs for blocked actions.
8) File transfer and encoding issues after export
Symptoms: KDM works locally but fails after being emailed or transferred; file appears corrupted or fails XML validation.
Possible causes and fixes:
- Email or transfer system altering file (MIME/text conversions) — Avoid sending KDMs as inline text in emails. Use binary-safe attachments (ZIP) or secure file transfer. Instruct recipients to avoid webmail clients that may alter line endings.
- ZIP or compression problems — If compressing KDMs, use standard ZIP with no encryption or incompatible compression methods. Verify contents after zipping.
- Character encoding changes — Ensure the KDM XML remains UTF-8 and that no system modifies encoding.
Diagnostic tips:
- After transfer, open the KDM in a text editor and compare checksums with the original:
sha256sum original.kdm received.kdm
- Use file transfer logs to confirm successful binary transfer.
9) Licensing or feature limitations
Symptoms: Features in EasyDCP KDM Generator+ are greyed out or KDM output is limited.
Possible causes and fixes:
- License expired or wrong license tier — Verify your EasyDCP license status and whether KDM Generator+ features are included. Contact your license administrator or supplier to renew or upgrade.
- Activation issues — If license activation failed, try re-entering activation codes, reactivating online, or contacting support for offline activation instructions.
Diagnostic tips:
- Check About/License dialogs in the application for status and expiry dates.
10) When to contact support
Contact EasyDCP support or your vendor when:
- You have exact error messages that you cannot resolve after basic troubleshooting.
- The issue appears to be a software bug (reproducible crash, unexplained corruption).
- License or activation problems persist.
- Recipient systems consistently refuse KDMs despite appearing valid in your environment.
When contacting support, provide:
- Exact error messages and screenshots.
- The CPL/PKL and KDM files (or sanitized copies).
- Recipient certificate (fingerprints) and log files.
- Steps you already tried and system details (OS version, EasyDCP version).
Conclusion
Most EasyDCP KDM Generator+ problems stem from certificate/key mismatches, timestamp issues, malformed inputs, or environment/permission constraints. Systematic troubleshooting—verify certificates and keys, check timestamps in UTC, validate CPL/PKL asset IDs, test with known-good samples, and monitor permissions and transfers—usually reveals the cause. If problems persist, collect detailed logs and contact EasyDCP support or your vendor with relevant files and error messages.